HONG KONG — Binance co-CEO Richard Teng said the exchange remains in a strong financial position after last week's theft of roughly $6.3 billion, the largest crypto hack on record, adding that 95% of the stolen funds had already been replaced and reassuring users that their assets were safe.

Teng made the remarks on Tuesday at Hong Kong Fintech Week. He said deposits and withdrawals had largely returned to normal and that a full review of the hack would be released later. Reuters quoted Teng as calling the hack a painful lesson and saying Binance took responsibility for it. He added that customer funds were safe and that the company would come out of the incident stronger.

Binance processes about $95 billion worth of crypto and derivatives trades each day and says it services more than 335 million users worldwide.

Covering the losses

Teng said the stolen assets were covered using the Secure Asset Fund for Users (SAFU), in addition to other company funds set aside for that purpose. SAFU is a Bitcoin reserve Binance created in 2018, originally worth about $1 billion — smaller than the amount stolen in this incident.

The 95% recovery covers tokens that are easier to buy and sell. The remaining 5%, which will prove relatively hard to acquire, will be replaced through private traders rather than purchased on public exchanges.

According to Reuters, Binance had replaced 90% of the stolen funds by November 1, a figure that rose to 95% by November 3. The exchange has also set aside about $6.34 billion to cover the losses, slightly more than the amount stolen.

The company has, however, not released an audited report showing where the money is held. So far, its claims about its financial health rest partly on its own statements. The full review Teng promised is the next step to watch for fuller detail behind those numbers.

Binance added that customers withdrew a net $4.72 billion by November 2, about 3% of the assets held on the exchange. Most of those withdrawals were made in Tether's USDT stablecoin, Reuters reported.

FBI points to North Korea; Pyongyang denies

The FBI heaped the bulk of the blame on TraderTraitor, a North Korean hacking group linked to the Lazarus Group, in a statement issued on October 31. The bureau also said the group was behind the $1.5 billion Bybit hack in February 2025, which was the biggest crypto hack at the time — roughly a quarter the size of this theft. The attribution ties the two largest crypto hacks on record to the same group. The attackers are reportedly converting the stolen funds into ETH and using DeFi platforms and instant-swap services to cover their tracks.

Tether, Circle, Ripple, Arbitrum and Optimism have frozen about $2.85 billion of the stolen funds, The Next Web reported. That amounts to roughly 45% of the total taken.

North Korea denied the claims. Kim Yo Jong, the sister of leader Kim Jong Un, called the FBI's findings "absurd rhetoric and nothing new" in a statement released through North Korean state media on Tuesday.

The breach itself

Blockchain analysis firm TRM Labs found that most of the theft was carried out in about 20 minutes, with funds pushed across 10 different blockchains. According to Reuters, the drain started shortly after 20:00 GMT on October 29.

Binance has not publicly named any culprit of its own. The company first traced the breach to an engineer's compromised laptop, then identified other possible ways the attackers got in, though it said there was no sign that wallet private keys had been stolen. The incident has once again raised questions about whether users should keep their crypto on exchanges. How thoroughly the promised review explains the entry paths beyond the compromised laptop is the next piece of evidence for users weighing that question.