Binance, the world’s largest cryptocurrency exchange, says it has covered approximately $6 billion of the $6.3 billion in digital assets stolen during a major cyberattack, using its own financial resources to purchase replacement tokens for affected assets.
The development comes as the US Federal Bureau of Investigation (FBI) has formally attributed the October 29 attack to a North Korean state-sponsored cyber unit known as TraderTraitor. The incident has raised concerns across the cryptocurrency industry because of the scale of the theft and the potential impact on customer confidence.
Binance said the remaining portion of the stolen assets consists mainly of less-liquid tokens that may take longer to acquire in the required quantities. The company has committed to covering the financial impact of the incident rather than passing the losses on to its customers.
Also read: Binance Chief Zhao Pardoned by Donald Trump
Binance Covers $6 Billion of Stolen Cryptocurrency
In an update shared on Saturday, October 31, Binance said it had already covered around $6 billion of the estimated $6.3 billion loss.
The announcement followed an earlier update in which the exchange reported that approximately 90% of the stolen assets had been replenished. The remaining amount includes tokens outside the platform’s top ten listed assets, which are less liquid and may be more difficult to purchase in large quantities.
Binance is acquiring the missing assets through cryptocurrency markets and over-the-counter (OTC) trading channels.
The company has also stated that it has internally set aside approximately $6.34 billion to cover the losses. It maintains that customers will not bear the financial consequences of the attack.
The replenishment process involves purchasing replacement tokens so that the exchange can restore the affected asset balances. It is separate from efforts to locate and freeze cryptocurrency transferred by the attackers.
FBI Attributes Attack to North Korean Group TraderTraitor
The FBI confirmed on October 31 that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance.
The agency identified the cyber activity as TraderTraitor, a name used for a specific North Korean state-sponsored operation.
According to the FBI, investigators and partner agencies observed the attackers converting stolen cryptocurrency primarily into Ethereum (ETH).
Authorities expect the stolen assets to undergo further laundering through decentralised finance (DeFi) platforms and instant cryptocurrency swap services.
The FBI has urged cryptocurrency service providers, blockchain infrastructure operators, analytics companies and other industry participants to identify and block transactions connected to the addresses associated with the operation.
The agency has also published cryptocurrency wallet addresses linked to the activity to help private-sector organisations identify potentially suspicious transactions.
North Korea has historically denied using state-linked cyber units for espionage, financial theft and revenue generation. Its representatives did not respond to requests for comment on the latest allegations, according to Reuters.
Also read: PSX Continues Losing in PIA-Driven Cautious Trading
Around $3 Billion in Stolen Assets Located
Alongside purchasing replacement tokens, Binance has been working with blockchain intelligence firms, cryptocurrency companies and other industry partners to trace and freeze the stolen assets.
The exchange reported that approximately $3 billion worth of affected cryptocurrency had been located on-chain as of Friday, October 30.
Locating or freezing stolen funds is different from replacing the assets. The first involves identifying cryptocurrency connected to the attack and attempting to prevent its movement, while the second involves Binance purchasing equivalent tokens to cover the financial shortfall.
These two efforts are central to the company’s response.
Binance has said it will continue cooperating with law enforcement agencies, blockchain analytics providers and other partners to trace the funds and prevent further transfers.
SAFU Fund and Company Reserves Used to Cover Losses
Binance is financing the replacement of stolen cryptocurrency through several sources, including its Secure Asset Fund for Users (SAFU), Futures Insurance Fund and corporate treasury.
SAFU is an emergency reserve established by Binance to protect customers in exceptional circumstances, including security breaches and other major platform incidents.
The exchange previously maintained approximately $1 billion in this reserve. Co-CEO Yi He said that 50% of the SAFU funds would be used as part of the response to the attack.
Binance has committed to replenishing the reserve so that it returns to approximately $1 billion.
Some funds are also being drawn from the Futures Insurance Fund, while the company’s own corporate resources are being used to purchase additional tokens.
The decision to use multiple funding sources reflects the scale of the incident and the exchange’s commitment to meeting the financial obligations created by the theft.
Also read: Pakistan Reports Nearly 40 Million Crypto Accounts
How the $6.3 Billion Binance Hack Happened
Binance described the incident as a complex cyberattack involving compromised infrastructure and unauthorised transactions.
According to the company’s initial investigation, the attack may have involved a compromised laptop belonging to a DevOps engineer. This reportedly allowed the attackers to gain access to a service container and submit unauthorised withdrawal transactions.
The company also said the breach involved malicious software designed to delete evidence of its activity, making the investigation and tracing process more difficult.
Binance reported that it had found no evidence that cryptocurrency wallet private keys were leaked.
The estimated impact of the incident was approximately $6.3 billion in token assets, following the compromise of its hot wallets on October 29.
The exchange responded by revoking affected authorisations, strengthening security controls and temporarily suspending withdrawals while additional checks were carried out.
Deposits and other unaffected services remained operational, according to Binance’s security updates.
Binance Plans to Resume Withdrawals on November 1
The temporary suspension of withdrawals became an important concern for customers following the discovery of the hack.
Binance said it was working to restore withdrawal services after completing security reviews, implementing additional safeguards and checking the integrity of affected systems.
In its October 31 recovery update, the company said it remained on track to resume withdrawals on Sunday, November 1, 2026. It said further details would be provided once the arrangements were confirmed.
The planned reopening was intended to reassure customers that the exchange was making progress towards restoring normal operations.
However, the resumption of withdrawals remained subject to Binance’s security checks and official confirmation.
Binance Updates Proof of Reserves for Customer Assets
The exchange has also taken a new snapshot of customer assets held on its platform as part of its Proof of Reserves process.
The snapshot was recorded at 00:00 GMT on October 31, 2026, and is intended to provide updated information about assets held by Binance.
The company said that customers holding ten listed cryptocurrencies would be able to verify that their assets were backed at a minimum ratio of 1:1 once the complete proof became available.
The ten listed assets are:
- Bitcoin (BTC)
- Ethereum (ETH)
- Tether (USDT)
- BNB (BNB)
- Solana (SOL)
- USD Coin (USDC)
- XRP (XRP)
- USD1 (USD1)
- Ripple USD (RLUSD)
- Zcash (ZEC)
Binance said the complete zero-knowledge proof would require approximately 40 to 50 hours of processing and was expected to become available by November 3, 2026, in UTC.
The updated snapshot is part of the exchange’s effort to provide customers with information about the backing of their assets following the security incident.
Also read: PKR Gains Ground Against USD
What the Binance Hack Means for the Cryptocurrency Industry
The incident has renewed concerns about the security of major cryptocurrency exchanges and the risks associated with digital asset platforms.
The reported loss of $6.3 billion highlights how a successful attack can create financial and operational challenges even for one of the world’s largest cryptocurrency companies.
The FBI’s attribution of the theft to TraderTraitor also places renewed attention on North Korean-linked cyber operations and the use of cryptocurrency to move and launder illicit funds.
For Binance customers, the immediate priorities are the restoration of withdrawal services, the completion of replacement asset purchases and the publication of updated reserve information.
Although the exchange says it has covered most of the stolen amount, the remaining less-liquid assets still need to be sourced.
Binance’s response will therefore remain under scrutiny as the company works to complete the replenishment process, restore its SAFU reserve and demonstrate that customer assets remain adequately backed.
The attack is also likely to keep cryptocurrency exchanges and blockchain service providers focused on stronger infrastructure security, monitoring suspicious transactions and improving cooperation with law enforcement agencies.
Also read: Pakistan Moves Ahead on Digital Finance with Binance Collaboration
