Binance says 90% of stolen crypto replenished after record $6.3 billion hack, withdrawals due back on Sunday
Binance said on Saturday it has replaced 90 per cent of the cryptocurrency stolen in Thursday’s record $6.3 billion hack, up from 80 per cent in its previous update, with ten major tokens now fully backed and withdrawals on track to reopen on Sunday, 1 November.
Binance, the world’s largest cryptocurrency exchange, said on Saturday that it has replenished 90 per cent of the cryptocurrency stolen in Thursday’s record $6.3 billion hack, in its third security update since the breach, as it prepares to reopen withdrawals on Sunday, 1 November.
The figure is up from about 80 per cent in the exchange’s previous update, and it means the shortfall in assets backing customer balances has narrowed sharply within two days of the attack. “We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%. Our users will not bear the financial impact of this incident,” co-chief executive Richard Teng said in a statement posted on X on Saturday.
The hack, disclosed on Thursday, 29 October, is the largest digital asset theft in history. According to the exchange and blockchain analysts, unauthorised transactions drained assets from Binance’s hot-wallet infrastructure from about 20:05 UTC on Thursday, and the exchange then halted withdrawals while it assessed the damage. Its early findings pointed to a possibly compromised employee laptop that allowed unauthorised withdrawal submissions, and it said it had found no evidence that wallet private keys had been leaked.
Ten major cryptocurrencies are now fully backed at 100 per cent, Binance said: bitcoin (BTC), ether (ETH), USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. That matters because it means customers holding those tokens are covered in full, even before the remaining shortfall is closed. The outstanding 10 per cent consists of less liquid tokens outside that group, which Binance said it is still buying through public markets and over-the-counter trades with industry partners, with no confirmed completion date for that final portion.
The replacement assets are being paid for from three sources, the exchange said: its own corporate treasury, a portion of its Futures insurance fund, and a partial deployment of its Secure Asset Fund for Users (SAFU), the emergency reserve it created in 2018 to protect customers after security breaches. The SAFU deployment is expected to happen over the next 24 hours, and Binance has committed to restoring the fund to about $1 billion afterwards, so it remains available as a safety net.
Binance said it has set aside more than $6.34 billion in company funds to cover the losses in total, a sum slightly above the estimated $6.3 billion stolen. It also published a new proof-of-reserves snapshot taken at midnight UTC on 31 October, showing coverage ratios of 100 per cent or more for the named tokens, with the full cryptographic proof — which would let users independently verify that their own balances are included — expected by Tuesday, 3 November, because generating it takes 40 to 50 hours of computation.
Replenishing stolen assets is not the same as recovering the stolen coins themselves, and the two tracks should not be added together. Separately from the replenishment, Binance reported in its previous update that about $3 billion in stolen funds had been frozen on-chain through cooperation with blockchain investigators, asset issuers and other exchanges, while the criminal investigation continues. US federal investigators, including the FBI and the Secret Service, are working with Binance to trace and freeze funds, and blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a hacking group linked to North Korea — a connection President Donald Trump has said officials are still investigating.
The hack shook crypto markets on Friday, the day after the theft was confirmed. Shares in listed crypto companies fell sharply, with Coinbase dropping more than 13 per cent, and bitcoin briefly dipped below $77,000 before recovering to trade at around $77,255 by Friday’s close, according to market reports. Figures in this post were checked against Binance’s Saturday update and Reuters’ Saturday report at 00:25 PKT on 1 November 2026.
For customers, the immediate question is access to their money. Binance said it remains on track to reopen withdrawals on Sunday, 1 November, within the timeframe it set earlier, after having suspended them following the breach. If that reopening goes ahead smoothly, it will be the first real test of whether the replenishment and the new proof-of-reserves snapshot are enough to restore confidence after the largest theft the industry has ever seen.
What happens next will be watched on three fronts: whether the final 10 per cent of less liquid tokens can be bought without moving their prices sharply, whether the full cryptographic proof due by 3 November verifies the 1:1 backing Binance claims, and whether investigators can freeze or recover more of the stolen funds before they are laundered. The exchange’s promise is unambiguous — it says it will absorb the loss in full — but the coming days will show whether the market believes the balance sheet matches the statement.
This post is market news information only, not financial advice.
