Binance said it has replenished approximately 90% of the cryptocurrency stolen in a $6.3 billion hack, using company funds to absorb the losses. The exchange plans to resume withdrawals on Sunday, November 1, after completing security checks, with services expected to return in phases.

The announcement came two days after the attack, during which Binance suspended withdrawals while reviewing its systems. Co-CEO Richard Teng said users would not bear the financial impact. Cryptocurrency prices fell on Friday following the breach, with Bitcoin and other major assets coming under pressure.

Binance Draws on Three Funding Sources

Binance said it had set aside more than $6.34 billion in company funds to cover the losses. The latest update raised the reported replenishment rate from approximately 80% in the previous statement to 90%.

Update: SAFU fund transfer is complete – this was the large 7,499 $BTC transfer visible here: — Binance (@binance) October 31, 2026

The exchange said its response relies on three funding sources: Binance’s corporate treasury, part of its futures insurance fund and the Secure Asset Fund for Users, or SAFU. Binance expected to deploy part of SAFU over the following 24 hours.

Before the hack, SAFU served as an emergency fund for exceptional security incidents. Binance said it plans to restore the fund to approximately $1 billion after using part of it to cover the losses.

The exchange is purchasing missing assets through open markets and over-the-counter transactions. Over-the-counter trades are arranged outside public order books and can help buyers source large quantities.

Binance said the remaining 10% consists of less liquid tokens outside the ten assets it identified as fully backed. Those tokens may take longer to acquire in the amounts required.

The exchange also worked with law enforcement, token issuers and other partners to prevent stolen assets from moving. Binance said the parties froze approximately $3 billion on-chain. These frozen assets are separate from the replacement assets Binance is acquiring. A freeze restricts movement but does not automatically return the assets to the exchange.

Withdrawals and Security Investigation

Binance said withdrawals remained on track to resume on November 1. Its earlier update stated that services would return in phases, subject to security checks. Deposits and other unaffected platform services remained operational, according to the company.

The investigation has expanded beyond an initially suspected compromised laptop. Binance said investigators identified additional points of breach and were still working to establish the full sequence of events. Security measures include revoking affected authorizations and reviewing the compromised infrastructure. Binance plans to publish a detailed incident report.

Teng also described malicious software that deleted evidence of its activity, making the investigation more difficult. Binance said on Friday that it had found no evidence that wallet private keys were leaked.

Blockchain intelligence firm TRM Labs attributed the theft to the North Korea-linked group TraderTraitor. The firm said its assessment was based on on-chain and off-chain intelligence.

Proof-of-Reserves Snapshot Published

Following the hack, Binance published a proof-of-reserves snapshot taken at midnight UTC on October 31. The report provides a view of the assets Binance says it holds against customer balances.

The exchange said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed. The snapshot reflects holdings at a specific time and excludes deposits and withdrawals made afterward.

Binance said generating the full cryptographic proof would take approximately 40 to 50 hours. According to the exchange, the process will allow holders of the named tokens to verify their balances against Binance’s reported liabilities.

Binance expects to make the full proof available by November 3. The exchange said the proof will allow users to verify a minimum backing ratio of one to one.