Binance says it has replaced approximately $6 billion of the $6.3 billion in cryptocurrency stolen during a major security breach, using its own financial resources to purchase replacement tokens. The exchange says it will absorb the financial impact of the incident rather than pass the losses on to customers. The remaining uncovered amount consists mainly of less-liquid cryptocurrencies that may take longer to acquire.
The development follows one of the largest reported cryptocurrency thefts, which targeted Binance’s hot wallets on October 29, 2026. The FBI has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit. Binance has also been working with law enforcement, blockchain intelligence companies and cryptocurrency issuers to trace and freeze the stolen assets.
Key Takeaways
- Binance says it has covered approximately $6 billion of the $6.3 billion stolen in the hack.
- The exchange is using its corporate treasury, part of its Secure Asset Fund for Users (SAFU), and its futures insurance fund to replace the stolen tokens.
- The remaining shortfall is approximately 5% of the original loss, according to the latest Reuters report.
- Around $3 billion in affected assets has been located and frozen by industry partners, according to Binance.
- The FBI has attributed the attack to North Korea’s TraderTraitor hacking unit.
- Binance plans to restore withdrawals in phases while completing security checks.
Binance Replaces Most of the Stolen Cryptocurrency
Binance initially announced that it had allocated more than $6.34 billion in company resources to cover the losses. In its October 30 update, the exchange said it had already secured approximately $5 billion in the exact cryptocurrency assets affected by the incident, representing around 80% of the stolen amount.
A subsequent update on October 31 raised the coverage figure to 90%. The exchange said that customers holding ten major cryptocurrencies, including Bitcoin, Ethereum, USDT, BNB and Solana, were fully backed.
By November 1, Reuters reported that Binance had covered approximately $6 billion, or around 95% of the $6.3 billion loss.
The remaining amount involves smaller and less-liquid tokens. These assets can be harder to purchase in large quantities because trading volumes may be limited. Binance says it is continuing to acquire the outstanding tokens through cryptocurrency exchanges and over-the-counter transactions.
The exchange has committed to covering the entire financial impact of the incident.
Where Is Binance Getting the Money?
Binance is using several internal financial resources to replace the stolen cryptocurrency. The company has identified three main sources:
| Funding source | Purpose |
|---|---|
| Secure Asset Fund for Users (SAFU) | Emergency reserve used to protect customers against unexpected losses |
| Futures Insurance Fund | Reserve used to support risk management in futures trading |
| Corporate treasury | Binance’s own financial resources used to purchase replacement tokens |
SAFU is an emergency protection fund established by Binance in 2018. It is designed to help protect users during unexpected events, including security breaches.
Binance has said it will replenish SAFU to approximately $1 billion after using part of the fund for the recovery effort. The exchange also said it used only a portion of its futures insurance reserves and that the remaining balance continues to meet its risk-management requirements.
The important distinction is that Binance is replacing the missing assets with its own resources. The $6 billion coverage figure does not mean the exchange has recovered $6 billion directly from the attackers.
Around $3 Billion in Stolen Assets Has Been Frozen
Alongside purchasing replacement tokens, Binance is working with cryptocurrency issuers, blockchain intelligence firms and other industry participants to trace the stolen funds.
The exchange said approximately $3 billion in affected assets had been frozen on-chain by its partners as of its October 30 update.
Several cryptocurrency companies have reportedly helped freeze assets connected to the incident, including issuers of major stablecoins and other digital currencies.
However, frozen assets and replacement assets are two different things. Freezing prevents identified funds from being moved or spent through supported systems, while replacement involves Binance acquiring new tokens to cover the shortfall.
The $3 billion in frozen assets should therefore not be added to the $6 billion Binance says it has replaced as though both figures represent the same type of recovery.
The company is continuing to coordinate with law enforcement and industry partners to identify the attackers and recover the frozen funds.
FBI Attributes the Attack to North Korea’s TraderTraitor Group
The FBI said the attack was carried out by TraderTraitor, a hacking unit linked to North Korea.
According to the agency, members of the group were observed converting stolen cryptocurrency into Ethereum. Investigators also expect further attempts to launder the assets through related technology and transactions.
The theft reportedly unfolded rapidly, with a substantial portion of the funds moved within approximately 20 minutes.
Binance initially suspected that a compromised employee laptop may have played a role in the incident. However, its subsequent investigation identified additional points of breach, suggesting that the attack involved a more complicated sequence than a single compromised device.
The exchange said it had found no evidence that wallet private keys were leaked. Its investigation into the full attack method remains ongoing.
North Korea has historically denied allegations that state-linked cyber units conduct cryptocurrency theft and other cyber operations. The FBI’s attribution is an official investigative assessment, while the full technical findings of the Binance breach have yet to be publicly established.
Binance Plans to Resume Withdrawals in Phases
Binance temporarily suspended withdrawals after discovering the security incident. The measure was intended to allow the exchange to investigate the breach, strengthen security controls and verify the integrity of affected systems.
Deposits and other unaffected platform services remained operational during the suspension.
According to Reuters, Binance planned to begin restoring withdrawals on November 1, with an initial phase covering 15 cryptocurrency assets, including Bitcoin, Ethereum, XRP and Dogecoin. The reported initial withdrawal window was between 0600 and 0900 GMT, subject to the exchange’s security checks.
The exchange has said withdrawals would be restored through a phased process rather than reopening every asset and service simultaneously.
Binance has also published a new Proof of Reserves snapshot dated October 31. It said users holding ten specified cryptocurrencies would be able to independently verify that their balances were backed at least one-to-one once the full cryptographic proof became available.
The exchange expected the complete proof to be generated by November 3.
The Bigger Picture
The Binance incident highlights the financial and operational risks associated with cryptocurrency exchanges, particularly the systems used to manage hot wallets. These wallets remain connected to online infrastructure, allowing exchanges to process transactions and withdrawals quickly. However, their connectivity also makes security controls, access permissions and internal monitoring critical.
The incident also demonstrates the difference between protecting customer balances and recovering stolen cryptocurrency. Binance’s decision to use its own resources to replace missing tokens may reduce the immediate impact on customers, but it does not mean the stolen assets have been returned or that the attackers have been identified and apprehended.
The response has also required coordination between exchanges, blockchain intelligence companies, law enforcement agencies and cryptocurrency issuers. The reported freezing of billions of dollars in assets shows how cooperation across the industry can help restrict the movement of stolen funds.
Looking Ahead
Binance’s immediate priorities are to complete the replacement of the remaining less-liquid tokens, restore withdrawal services safely and publish more information about the security incident. Its commitment to replenish SAFU and provide updated Proof of Reserves information will also be important for customers assessing the exchange’s financial position.
The longer-term impact will depend on the findings of the investigation, the amount of stolen cryptocurrency that can ultimately be recovered and the security improvements Binance implements. Although the exchange says it will absorb the financial losses, the incident is likely to keep attention on cryptocurrency custody, exchange security and the ability of large trading platforms to withstand major cyberattacks.
Frequently Asked Questions
1. How much cryptocurrency was stolen from Binance?
Binance reported that approximately $6.3 billion worth of cryptocurrency was stolen from its hot wallets during the October 29, 2026 security incident.
2. How much of the stolen cryptocurrency has Binance covered?
Binance said it had covered approximately $6 billion by November 1, 2026, using its own financial resources to purchase replacement tokens.
3. Has Binance recovered the $6 billion from hackers?
No. The $6 billion figure refers to replacement assets purchased by Binance. It does not mean the exchange has recovered that amount directly from the attackers.
4. Who was responsible for the Binance hack?
The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit. The investigation into the full attack method remains ongoing.
5. Will Binance customers lose their money?
Binance has said it will absorb the financial impact of the incident rather than pass the losses on to users. It has also reported that major listed cryptocurrencies are fully backed.
6. What is Binance’s SAFU fund?
SAFU stands for Secure Asset Fund for Users. It is an emergency reserve established by Binance in 2018 to help protect customers against unexpected losses, including security incidents.
7. When will Binance withdrawals resume?
Binance planned to resume withdrawals in phases on November 1, 2026, beginning with a group of 15 cryptocurrencies, subject to security checks and further exchange updates.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
