Binance says it has covered 90% of losses from a record $6.3 billion hack and will resume withdrawals Sunday

Binance has covered 90% of the roughly $6.3 billion in assets stolen in a hack announced Thursday. The scale is unprecedented. It is the largest crypto theft on record, and Binance is the world’s largest cryptocurrency exchange.

Binance has consistently pledged to cover 100% of the losses from the theft. “Binance will absorb the financial impact of these stolen funds, not our users,” the company said in a statement on Saturday. The exchange said its next milestone would be resuming withdrawal services for users, subject to security checks, while it continues its investigation into the attack. Binance said it remained on track to reopen withdrawals on Sunday 1 November and would provide a further update once details were confirmed. The remaining 10% may take longer to source in the required amounts, the company said.

Binance said it has set aside more than $6.34bn in company funds to cover the losses from the theft. The exchange is tapping its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish the stolen assets. “Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions,” Binance said in its statement. On Friday, Binance said it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms, and partners. The US Secret Service said on Friday it is “working around the clock” with private sector partners to identify, freeze, trace, and recover funds stolen from Binance. The investigation is ongoing, and Binance declined to discuss additional details or updates on its investigation, referring questions to its latest statement.

“All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%,” Binance said in a statement. The outstanding 10% consists of tokens outside Binance’s top 10 that are less liquid, which means they may take longer to source in the required amounts. Binance said it will continue to buy the remaining relevant token assets through market and over-the-counter channels until the covered amount reaches 100% for all tokens, the exchange said.

How the breach unfolded

The stolen assets were taken from Binance’s hot wallets, the exchange said. Binance’s initial investigation suggested a compromised engineer’s laptop allowed unauthorized withdrawals, but a later update indicated a more complex process involving additional points of breach rather than the misuse of a single engineer’s permissions. Richard Teng, Binance’s co-chief executive officer, said the hack was carried out by more than one person using sophisticated methods to hide their tracks, such as a self-destruct mechanism. It still is not clear how the attack took place. Binance, founded in China in 2017, lets users buy, sell, and trade digital assets and is estimated to have hundreds of millions of users worldwide.

Trail points to North Korea

Blockchain analytics firms point to North Korean state-backed hackers as the likely culprits. Two major firms say they have intelligence pointing to a group called the Lazarus Group, also known as TraderTraitor. TRM Labs, a blockchain intelligence and AI investigations company, separately pointed to North Korean state-backed hackers as the potential culprits and said the attack bears hallmarks of earlier heists. “Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” TRM Labs said. The hack eclipses the previous record of a $1.5bn heist on the Bybit exchange in 2025. The FBI said North Korea was responsible for the theft of $1.5bn on the Bybit exchange. North Korea has always denied involvement in these attacks.