Binance sets aside USD 6.34 billion to cover crypto hack losses, targets phased withdrawal resumption

Cryptocurrency exchange Binance has set aside more than USD 6.34 billion in company funds to cover losses from the USD 6.3 billion security breach, with about 80 per cent of the stolen token assets already replenished, as the company works to restore withdrawal services in phases.

In its second security incident recovery update, Binance said it would absorb the entire financial impact of the theft through its Secure Asset Fund for Users (SAFU) and corporate treasury, ensuring users do not bear the losses.

"We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users," the exchange said in the statement.


The company said it had already secured USD 5 billion in the same digital assets that were stolen, including USDC, USDT, Bitcoin (BTC), Ether (ETH) and BNB.

"This means that we have already covered approximately 80% of the impacted amount. We are actively buying the remaining relevant token assets through market and OTC channels," Binance said.

The exchange confirmed that its hot wallets were compromised at around 20:05 UTC on October 29, resulting in unauthorised withdrawals of approximately USD 6.3 billion worth of digital assets.

As part of its recovery efforts, Binance said approximately USD 3 billion in stolen assets had been frozen on blockchain networks through coordination with law enforcement agencies, blockchain intelligence firms, asset issuers and industry partners.

The company also provided a timeline for restoring services, saying its technical team was targeting the phased resumption of withdrawals within approximately 34 hours, subject to the completion of security checks.

Deposits and other unaffected platform services remain operational, it said.

Binance further announced plans to publish an updated Proof of Reserves report by Monday, November 2, to allow users to verify the digital assets backing their account balances.

On the cause of the breach, the exchange said its initial investigation had pointed to a compromised laptop, but subsequent findings revealed additional points of intrusion.

"Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach," it said.

The company reiterated that it had found no evidence of wallet private keys being leaked and said further technical findings were expected within approximately 48 hours, subject to verification.

Meanwhile, according to Reuters, blockchain investigation firms TRM Labs and Chainalysis have linked the USD 6.3 billion theft to a North Korean hacking group known as TraderTraitor.

Cybersecurity experts cited by Reuters said proceeds from North Korean cryptocurrency thefts have helped fund the country's weapons programmes.

Binance has not publicly confirmed who was responsible for the attack and said its investigation remains ongoing.

The exchange said it would publish a detailed technical report outlining how the breach occurred and the additional security measures being introduced to prevent similar incidents.