Binance Has Replaced 90% of the $6.3 Billion Hack — Withdrawals Due Sunday

Binance said on Saturday, October 31 that it has replenished 90% of the $6.3 billion stolen in Thursday's hack — up from 80% a day earlier — and remains on track to reopen withdrawals on Sunday, November 1. The exchange says users will not bear the loss: it set aside about $6.34 billion of its own money, and customer balances in Bitcoin, Ether and eight other major tokens are now fully backed.

What happened on Saturday?

Binance, the world's largest cryptocurrency exchange, posted a fresh update on Saturday saying it has now replaced 90% of the assets drained in the record $6.3 billion breach. Co-CEO Richard Teng said on X: "We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident," according to Reuters. CoinDesk and Cointelegraph reported the same 90% figure, up from about 80% in Friday's update.

Which tokens are fully backed again?

Binance said customer holdings of ten tokens are now backed at 100% or more: Bitcoin (BTC), Ether (ETH), USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% of the shortfall consists of less liquid tokens, which the exchange said may take longer to acquire in the quantities it needs. It is buying those tokens through public markets and over-the-counter trades, with industry partners.

Where is the replacement money coming from?

Binance said it had already set aside more than $6.34 billion in company funds, including about $5 billion held in the affected cryptocurrencies. That money is separate from roughly $3 billion in stolen assets that partners such as Tether and Circle froze after the hack, which stops the attacker spending them but does not itself restore balances. The replacement purchases are being funded from three places: Binance's corporate treasury, a portion of its futures insurance fund, and a partial deployment of the Secure Asset Fund for Users, known as SAFU, its roughly $1 billion emergency reserve. Binance said it would restore SAFU to about $1 billion afterwards.

Why is this story blowing up?

This was the largest cryptocurrency theft on record, and it landed in the middle of an already brutal week for markets. Bitcoin traded near $77,000 on Saturday, roughly 39% below its October 2025 all-time high above $126,000, after forced liquidations and $643 million of outflows from U.S. spot Bitcoin ETFs on Friday. Traders spent Saturday watching one question: would the world's biggest exchange make customers whole, and would withdrawals actually reopen? The 90% update, with a Sunday deadline attached, made it the weekend's biggest finance story.

Who carried out the attack?

Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korea-linked hacking group, CoinDesk and Cointelegraph reported. Binance said Friday that the breach was a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity, and CoinDesk reported that investigators have since found additional breach points. The investigation remains open, and the stolen crypto itself has not been recovered — replacing balances is not the same as getting the stolen funds back.

What still needs to be proved?

Binance published a new proof-of-reserves snapshot, taken at midnight UTC on October 31, showing coverage ratios of 100% or more for the named tokens. The full cryptographic proof, which would let users verify independently that their own balances are included in Binance's reported liabilities, is expected by November 3. Cointelegraph noted that the exchange says that zero-knowledge proof takes about 40 to 50 hours to generate, and that security firm CertiK said on Friday it needed more information to verify Binance's claimed $5 billion in replacement cryptocurrencies. Saturday's update is Binance's own account, with independent verification still to come.

What's next?

The next test is Sunday, November 1, when withdrawals are due to resume, subject to security checks. After that comes the remaining 10% of less liquid tokens, the full proof-of-reserves publication expected by November 3, and the restoration of the SAFU fund to about $1 billion. If withdrawals reopen on schedule and the proof matches the snapshot, the largest hack in crypto history will also become the largest exchange-funded recovery.

Sources

CoinDesk — Binance says it has replaced 90% of stolen crypto after massive $6.3 billion breach
Cointelegraph — Binance says 90% of assets replenished after $6.3B hack
Reuters via WNFL — Binance says it has covered 90% of losses from $6.3 billion hack so far
CryptoTimes — Bitcoin price today: BTC falls to $77K as liquidations hit, ETFs see $643M outflow

FAQ

Has Binance replaced all of the stolen crypto?

No. Binance said on Saturday it has replenished 90% of the $6.3 billion stolen, up from 80% a day earlier. The remaining 10% is in less liquid tokens that will take longer to buy.

When will Binance withdrawals reopen?

Binance said withdrawals, paused since the hack, remain on track to resume on Sunday, November 1, subject to security checks.

Will Binance users lose money from the hack?

Binance says no. It set aside about $6.34 billion of its own funds, drawn from its corporate treasury, futures insurance fund and SAFU reserve, and says it will absorb the financial impact, not users.

Who is blamed for the Binance hack?

Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korea-linked hacking group. The investigation is still open.