Binance said Friday that it has set aside more than $6.34 billion in company funds to cover losses from a hack that drained an estimated $6.3 billion from the exchange, the largest cryptocurrency theft on record. Roughly $5 billion of that amount is already held in the same tokens that were stolen, and the exchange plans to buy the rest on public markets and over the counter.

The company also said about $3 billion in affected assets has been frozen with help from industry partners. Those frozen assets are not counted in the set-aside funds and are being pursued with law enforcement for recovery.

Blockchain analytics firms TRM Labs and Chainalysis have linked the attack to TraderTraitor, a North Korean hacking group. Deposits remain open on the exchange, while withdrawals are paused as security checks finish.

🚨UPDATE: Binance has set aside over $6.34 BILLION from company reserves to cover losses from the hack. $5 BILLION of that, roughly 80% of the TOTAL amount affected by the hack, is held in the same tokens involved, including USDC, USDT, BTC, ETH and BNB. Deposits and…

— Coin Bureau (@coinbureau) October 31, 2026

$5 Billion Held in the Stolen Tokens

“The $5 billion is held in the exact token assets that are required. These assets are in Binance custody,” a Binance spokesperson told Cointelegraph. The exchange did not say when it acquired the assets.

The spokesperson declined to share wallet addresses, citing security reasons. The holdings will appear in the exchange's next proof-of-reserves report, which shows the assets it holds to back customer balances.

What Happened in the Hack

Late Thursday, attackers drained an estimated $6.3 billion from Binance hot wallets across 10 blockchains. The stolen funds included bitcoin, ether, and the stablecoins USDT and USDC. Most of the coins left in a burst that lasted about 20 minutes.

Binance initially pointed to a compromised laptop belonging to a DevOps engineer, which allowed attackers to submit unauthorized withdrawal requests through internal systems. The company later said it found additional exploit points but has seen no evidence that wallet private keys were stolen.

TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group. Chainalysis separately linked it to a North Korean group with high confidence, citing the speed and skill of the attack.

Chainalysis said it is seeing money-laundering methods it has never observed before. Thousands of transactions took place in a short time, which suggests automated scripts. The attackers are circulating coins among many addresses, often sending them back to earlier wallets.

How Binance Plans to Cover Losses

Binance said it is using its own money to buy matching tokens so that user balances can be restored one-for-one. The exchange is purchasing the remaining amount on public markets and over the counter.

The company said about $3 billion in affected assets has been frozen with help from industry partners, and those assets are being worked on with law enforcement for recovery. Binance added that it will continue using company resources to cover any confirmed shortfall.

The company also maintains its Secure Asset Fund for Users, an emergency reserve that has usually held about $1 billion in bitcoin. Nansen said it could not verify what funds Binance holds beyond its roughly $1.16 billion emergency fund. CertiK said it needs more information to verify the claimed $5 billion on-chain.

CertiK CEO Ronghui Gu estimated that the frozen assets and the emergency fund could cover about 66% of losses. That would leave a possible $2.1 billion gap, or about 1.3% of Binance's reported $165 billion in reserves.

Zhao and Yi He Point to Company Resources

Founder Changpeng Zhao said the company's SpaceX holdings are worth more than $1 billion. Co-founder Yi He said the exchange's yearly revenue is enough to cover the losses, and that Binance does not need to sell its SpaceX stake.

Elon, have a lot of respect for you, but bad time to troll. Please stop.

Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion.

Would appreciate if you show a little support. Thanks!

— CZ 🔶 BNB (@cz_binance) October 30, 2026

Zhao also said Binance holds the coins it lists because customers can pay trading fees in those tokens. He said Gulf, Binance's partner in Thailand, has offered financial support.

Binance has not said which tokens it still needs to buy or when it will finish the process. It has also not said how much stolen crypto has been recovered. The FUN token fell 90% early Friday.

Regulatory Reporting and Industry Context

Binance provides weekly reports on its company funds to Abu Dhabi's Financial Services Regulatory Authority. The exchange said that requirement began before the hack. DefiLlama has recorded 322 hacks in 2026 with more than $8.7 billion in losses.

Binance said it will post updates as recovery work continues. It earlier said withdrawals could resume in about 45 to 48 hours.

This article originally appeared on CoinCentral.