Binance Says It Has Replaced 90% of $6.3B Hack Losses, Prepares Sunday Withdrawals
Binance said it tapped emergency funds and corporate reserves to replace stolen tokens while preparing phased withdrawal resumptions.
In short
- Binance stated that it replaced 90% of the assets stolen in the October 29, 2026 cyberattack and set aside approximately $6.34 billion in internal funds.
- The FBI confirmed that TraderTraitor, a North Korean state-sponsored cyber unit linked to the Lazarus Group, was responsible for the theft.
- Major stablecoin issuers and networks froze roughly $2.7 billion in stolen assets, while the attackers retain control of about $2.4 billion in assets beyond issuers' reach.
- Binance reported that top tokens are 100% backed and stated it remains on schedule to resume user withdrawals in phases starting Sunday.
Cryptocurrency exchange Binance announced that it has replaced 90% of the funds taken during a record-breaking $6.3 billion cyberattack, preparing to resume customer withdrawals in stages. The breach, which occurred on October 29, 2026, targeted the exchange's hot wallet infrastructure across ten distinct blockchains. As reported by The Guardian, Binance co-CEO Richard Teng stated that the company is committed to covering the remaining 10% and pledged that users will not bear the financial impact of the breach.
The scale of the intrusion marks the largest digital asset theft on record, surpassing the $1.5 billion hack suffered by Bybit in February 2025. Following the unauthorized outflows, the platform temporarily halted user withdrawals across several networks.
How Binance Replenished Billions in Customer Funds
To replace the siphoned holdings, Binance said it had set aside around $6.34 billion of company funds to acquire replacement assets through open-market purchases and over-the-counter channels. According to Business Insider, the exchange had replenished an estimated $5.7 billion within two days of the incident by drawing from several internal safety nets.
Binance confirmed that funding came from deploying part of its $1 billion Secure Asset Fund for Users (SAFU)—an emergency bitcoin reserve established to protect depositors during security failures—as well as portions of its Futures Insurance Fund and primary corporate treasury. As reported by CNBC, Binance stated that all user balances in ten major tokens—Bitcoin (BTC), Ethereum (ETH), Tether (USDT), BNB, Solana (SOL), USD Coin (USDC), XRP, USD1, RLUSD, and Zcash (ZEC)—are now fully backed at a 1:1 ratio.
According to Binance, the outstanding 10% of unreplenished assets comprises secondary tokens outside the top ten. The company explained that these smaller assets are less liquid on public markets, meaning they may take longer to purchase.
Technical Scale and the EIP-7702 Compromise
Detailed on-chain forensic analysis published by TRM Labs revealed that the unauthorized transfers began on October 29 at 20:05 UTC. Within minutes, the attacker drained hot wallets across nine networks, while a second wave around 23:05 UTC hit Avalanche and Polygon. Ethereum accounted for the largest share of the theft at approximately $3.79 billion, including 200,630 ETH, 1.875 billion USDT, and 823 million USDC. Bitcoin outflows totaled 18,270 BTC, valued at roughly $1.47 billion.
On Ethereum, the attacker exploited an EIP-7702 delegation, an account abstraction standard introduced in Ethereum's Pectra upgrade in May 2025. This standard allows an account to delegate its execution logic to a designated smart contract. The attacker submitted 50 batch authorizations signed in advance by Binance's Ethereum hot wallet, linking it to an external sweeper contract under the hacker's control. Once executed, the contract drained the wallet's contents and repeatedly swept incoming user deposits over the following four hours.
In that initial window, Binance hot wallets across eight non-Ethereum chains executed ordinary signed transfers to the attacker's addresses, while Polygon was hit about two and a half hours later at 23:05 UTC. According to TRM Labs, because these disparate networks rely on separate key architectures and signing schemes, the evidence points to a broader compromise of Binance's centralized hot wallet signing infrastructure. While Binance initially suggested that a compromised DevOps engineer's laptop allowed unauthorized container access, Teng later revised that explanation, describing the breach as a complex operation involving malware designed to purge activity logs.
Freezes, Laundering, and Attribution to North Korea
On Saturday, the Federal Bureau of Investigation formally attributed the theft to TraderTraitor, an elite state-sponsored cyber group operating under North Korea's Lazarus Group. As reported by The Guardian, the FBI stated that the Democratic People's Republic of Korea was responsible for the theft and observed TraderTraitor converting pilfered assets into Ethereum. The agency urged private financial entities to monitor and block addresses tied to the laundering pipeline.
Coordinated industry countermeasures managed to restrict a large portion of the stolen funds. As detailed by TRM Labs, stablecoin issuers Tether, Circle, Ripple, and World Liberty Financial froze approximately $2.67 billion across various networks. Arbitrum's Security Council also exercised emergency administrative powers to extract 8,426 ETH and 74.6 million ARB—totaling around $30 million—from the attacker's wallet.
Despite those freezes, the perpetrators managed to move substantial amounts into unfreezable digital assets. The attacker sold roughly 325 million USDT through decentralized protocols at a discount of more than 10% to acquire 122,300 ETH, borrowed nearly 19,760 ETH against USDT collateral on Aave, and routed stolen Bitcoin through peel chains to fracture the transaction trail. TRM Labs reported that the group retains control of over 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion, which cannot be frozen by centralized asset issuers.
Verification and Phased Withdrawal Resumption
To restore customer confidence, Binance implemented transparency measures while preparing to resume standard operations. As reported by Hindustan Times, the exchange executed a fresh Proof of Reserves snapshot as of October 31, 2026. The exchange noted that users will be able to verify that their deposited balances remain backed at least 1:1 once zero-knowledge proof generation completes, a process expected to conclude by November 3.
Binance confirmed on Sunday that phased withdrawal services had begun rolling out following operational security reviews. The company reiterated that the intrusion targeted corporate hot wallet reserves rather than individual account credentials or balances. Digital asset markets reacted sharply following news of the breach, with Bitcoin declining nearly 5%, Ethereum dropping roughly 6%, and Binance's native BNB token falling nearly 10%.
Questions people ask
How much money was stolen from Binance during the hack?
Blockchain intelligence firm TRM Labs calculated the total stolen assets across ten blockchains at approximately $6.36 billion at the time of the transfer, while law enforcement and Binance cited losses of roughly $6.3 billion.
How did Binance cover the stolen cryptocurrency?
According to Binance, it tapped its $1 billion Secure Asset Fund for Users (SAFU), a portion of its Futures Insurance Fund, and corporate treasury reserves to purchase replacement tokens on the open market and through private brokers.
Who carried out the $6.3 billion cyberattack?
The FBI and private intelligence firm TRM Labs attributed the attack to TraderTraitor, an elite state-sponsored cyber unit backed by North Korea and affiliated with the Lazarus Group.
When are Binance customer withdrawals resuming?
Binance announced that phased withdrawal services began rolling out on Sunday, November 1, 2026, subject to ongoing system security checks.
Sources
- Binance says 90% of losses from $6.3bn hack covered as FBI says North Korea behind attackThe Guardian, Nov 1, 2026
- Binance says 90% of $6.3 billion in crypto stolen in hack replenishedBusiness Insider, Oct 31, 2026
- Binance says 90% of $6.3 billion hack losses are now covered, plans to resume withdrawals SundayCNBC, Oct 31, 2026
- Binance says it has covered 90% of losses after $6.3 billion crypto hack | Hindustan TimesHindustan Times, Nov 1, 2026
- Binance says it has covered 90% of losses from $6.3 billion hackCNA, Oct 31, 2026
- North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in HistoryTRM Labs, Oct 30, 2026
How this story was made: the newsroom picked it up from Techmeme and Reddit, gathered the full text of the sources above, and drafted it with AI assistance. Every factual claim was then checked against those sources before publishing (43 claims checked). Illustrations marked as AI-generated are not photographs. Spotted an error? Tell us.
Published November 1, 2026 at 07:11 UTC
