Binance says it has replenished 90% of the roughly $6.3 billion stolen in last week’s hack, paying for it out of its own treasury and futures insurance fund rather than touching user deposits. The exchange is still aiming to reopen withdrawals this Sunday, November 1, and a fresh proof-of-reserves snapshot shows coverage back above 100% for every affected token. The last 10%, sitting in less liquid assets, could take longer to buy back on the open market, and Binance’s co-CEO now says investigators found more than one way the attackers got in.
This is the third chapter in a story that started Thursday, October 29, when Binance first flagged suspicious outflows and paused withdrawals. By Friday, blockchain forensics firms TRM Labs and Chainalysis had attributed the theft to TraderTraitor, the North Korea-linked hacking unit also known for draining exchanges through supply-chain compromises rather than brute-force exploits. Binance’s own account of the breach, as we covered when the attack was first confirmed and the losses climbed past $5.8 billion, pointed to a single compromised DevOps engineer laptop. That explanation didn’t survive the weekend.
Co-CEO Richard Teng said Friday that investigators had since found “additional breach points,” and the company now describes the investigation as still open rather than closed around one entry vector. That’s a meaningfully different picture than the one Binance gave when the loss total was first locked in at $6.36 billion and formally pinned on North Korea by TRM Labs with what the firm called high confidence. A single stolen laptop is a bad afternoon. Multiple undiscovered entry points into an exchange holding billions in customer assets is a different category of problem, and it’s the kind of detail that tends to surface only once the adrenaline of day one wears off and a real forensic team gets time with the logs.
The money side of the story has moved just as fast. Binance says it had already set aside more than $6.34 billion in company funds to cover the loss, separate from roughly $3 billion in stolen assets that partner platforms managed to freeze on-chain before the attackers could cash out. As of this update, the exchange says it has used that war chest, plus a portion of its futures insurance fund, to replace 90% of what was taken, up from about 80% a day earlier. Holdings in bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are now, in Binance’s words, fully backed again.
The insurance fund piece is worth slowing down on, because it’s not something exchanges reach for casually. Binance’s futures insurance fund normally exists to absorb losses when margin traders get wiped out and to limit forced position-closing during volatile swings, not to patch a security breach. Binance says it only moved the portion sitting above what the fund needs to meet its own risk requirements, and it’s committed to rebuilding its separate SAFU fund, the Secure Asset Fund for Users that’s existed since 2018 for exactly this kind of emergency, back up to roughly $1 billion. A partial SAFU deployment is expected within the next day. Pulling from three separate pools of capital at once, treasury, futures insurance, and SAFU, tells you the size of the hole was bigger than any single reserve could plug on its own.
Crypto markets haven’t fully shaken off the shock either. Bitcoin dropped toward the $76,000 range in the days after the hack first broke, and the sell-off triggered more than $1.5 billion in liquidations across margin trades as nervous traders cut exposure. Some institutional holders reportedly started pulling funds off exchanges altogether, a reflex that tends to follow any exchange-level breach regardless of how quickly the operator says it’s covering the gap. Binance isn’t the first major platform TraderTraitor has gone after, and security researchers have tracked the group’s methods evolving over several years, from fake job offers aimed at engineers to, increasingly, attacks that look like insider access rather than a straightforward external break-in.
On the verification side, Binance published a new reserves snapshot taken at midnight UTC on October 31 showing coverage ratios at or above 100% for the affected tokens, and the company says a full cryptographic proof will follow by November 3. That’s the same proof-of-reserves system CoinDesk had used days earlier to show that the specific wallets drained in the attack were among those backing customer holdings in the first place, which is part of why this recovery milestone matters beyond a press release. Self-reported reserve numbers from an exchange mid-crisis are not the same as an independent audit, and nothing here has been verified by a third party yet. But a published, checkable snapshot is a meaningfully stronger claim than a tweet saying “everyone’s funds are safe.”
The remaining 10% is where things get slower. Binance says those are less liquid tokens that it may take longer to acquire in the quantities needed, and it’s sourcing them through a mix of public market purchases and over-the-counter trades rather than printing them out of thin air. That’s a real constraint for any exchange trying to replace a nine-figure chunk of a specific altcoin without blowing up its own price in the process. If Sunday’s withdrawal reopening holds, it will be a genuinely fast turnaround for a breach of this size, roughly 72 hours from confirmed theft to resumed service, assuming the last 10% doesn’t become the thing that slips the timeline.
The political attention is new too. U.S. President Donald Trump addressed the breach directly, telling reporters “we don’t know” whether North Korea was responsible and that the administration is “looking at that.” That’s a notably more cautious line than the blockchain analysis firms have taken, and it’s worth remembering that North Korea’s crypto theft operations have funded a meaningful share of its weapons programs for years, which is exactly why attribution here isn’t just an academic exercise for security researchers.
The bottom line
Binance’s crisis response has been fast and, so far, well-funded, which is more than you can say for a lot of exchanges that have gotten hit this hard. But fast isn’t the same as finished. Ninety percent recovered still leaves hundreds of millions of dollars unaccounted for, the breach vector investigation is openly unresolved, and “withdrawals resume Sunday” is a target, not a confirmed fact, until it actually happens. The real test isn’t the number Binance puts out this weekend. It’s whether the “additional breach points” Teng mentioned turn out to be closed for good, or whether this story has a fourth chapter still coming.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
