Binance says it has replaced 90% of the roughly $6.3 billion stolen in Thursday’s hack, up from 80% in its previous update. If confirmed, the figure would exceed the largest cryptocurrency theft on record — the roughly $1.5 billion taken from Bybit in February 2025, an attack investigators also linked to North Korea. The exchange plans to resume withdrawals on 1 November, saying the process will begin in phases.

“We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%. Our users will not bear the financial impact of this incident,” co-CEO Richard Teng said on X on Saturday (post).

In its third and latest update, Binance said the 10 largest affected tokens are “fully backed 100%”. They are BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% consists of less-liquid tokens outside that group and may take longer to source.

Sources of the replacement funds

Binance said it used three sources to replace the stolen assets: a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund and its corporate treasury.

The company later confirmed in an X post that the SAFU transfer was complete, pointing to a transfer of 7,499 BTC visible on the blockchain. The transfer can be viewed through a Bitcoin address identified by Binance (blockchain explorer).

SAFU is an emergency reserve established in July 2018 for incidents including security breaches. It is held by Nest Clearing and Custody Limited, a clearing house regulated in Abu Dhabi. Binance said it would replenish the fund to about $1 billion.

The Futures insurance fund protects traders from deficit losses on bankrupt positions and limits forced liquidations, also known as auto-deleveraging. Binance said it released only the amount above the fund’s required size, while the remaining balance is a regulatory requirement. The exchange said the fund remains above the required coverage level, although no exchange can completely avoid auto-deleveraging.

Withdrawals and proof of reserves

Binance suspended withdrawals after the attack, which it said began when its hot wallets were compromised at about 20:05 UTC on Thursday. Hot wallets stay connected to the internet to process day-to-day transfers, which makes them more exposed than the offline cold storage exchanges typically use for the bulk of customer funds. Deposits and other unaffected services have remained operational.

The exchange had previously said withdrawals would resume within 48 hours. It now says withdrawals will reopen in phases on 1 November.

Binance has also published a new Proof of Reserves snapshot taken at midnight UTC on Saturday. Proof-of-reserves disclosures became widespread across major exchanges after the 2022 collapse of FTX. The complete zero-knowledge proof is expected to take 40 to 50 hours to generate. The company said holders of the 10 covered tokens will then be able to verify at least 1:1 backing, which it estimates will be available on Tuesday. In an earlier update, Binance had said the results would be ready by Monday.

Investigation remains ongoing

Binance’s initial assessment pointed to an engineer’s compromised laptop. Its second update said the investigation had “uncovered additional points of breach.” Teng described a “complex attack” involving a compromised laptop and malicious software designed to delete evidence. Binance said it had found no evidence that wallet private keys were leaked. Such keys, if compromised, would give an attacker direct control over the funds they protect.

According to Binance, about $3 billion of the stolen assets has been frozen on-chain. On-chain freezes rely on the issuers of tokens that support address blacklisting — a capability common among stablecoin issuers — while assets without an issuer, such as bitcoin, cannot be blocked this way. That figure is separate from the 90% replacement figure, which reflects assets being replaced rather than recovered.

Binance’s updates have not identified those responsible. TRM Labs and Chainalysis linked the attack to North Korea, according to an earlier TechNext24 report (report). Binance said it expects to share further technical findings within about 48 hours of its second update and will publish a full post-mortem.