Binance Says It Has Replaced 90% of $6.3 Billion Stolen, Withdrawals Set to Resume Sunday

Since Binance disclosed the Oct. 29 theft of about $6.3 billion in crypto, the exchange has gone from promising to make users whole to saying it has mostly done it. On Saturday, Oct. 31, Binance said it has replaced about 90% of the stolen assets.

The exchange said it remains on track to resume withdrawals on Sunday, Nov. 1, inside the 48-hour window co-founder Yi He gave earlier in the week.

Where the replacement money is coming from

Binance said the replenishment used funds from its corporate treasury and part of its futures insurance fund. It also said it is preparing to partially deploy its Secure Asset Fund for Users, known as SAFU, over the next 24 hours. SAFU is a $1 billion bitcoin reserve the exchange holds for security breaches.

The exchange said it is buying the outstanding stolen assets through open-market purchases and over-the-counter channels. The missing 10% is made up of less-liquid tokens that may take longer to source in the required amounts, Binance said.

It has set aside roughly $6.34 billion of company money to cover the losses. "Binance will absorb the financial impact of these stolen funds, not our users," the exchange said in its Saturday statement.

Ten tokens now backed 1:1, Binance says

Binance said holdings of 10 assets are now fully backed at 100%: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.

It also took a fresh Proof of Reserves snapshot at 00:00 UTC on Oct. 31. Once the full proof is published, Binance said, holders of those tokens will be able to check that their balances are backed at a minimum 1:1 ratio.

That verification is not available yet. Until it is, the 100% figure is Binance's own statement about its own books.

What investigators have said about the attack

Co-CEO Richard Teng said Friday the breach was a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity, which makes tracing harder.

Binance's initial findings, published Oct. 29, point to a compromised DevOps engineer's laptop. The exchange said an attacker used it to reach a service container and submit unauthorized withdrawal transactions. Binance said it has found no evidence of a wallet private key leak.

About $3 billion was frozen on-chain in the first hours. Tether CEO Paolo Ardoino said his company froze more than 1.567 billion USDT. Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC.

Binance has promised a detailed technical post-mortem once the investigation is complete and the facts are verified. It has not given a date.

The safety question for exchange customers

The reimbursement is the exchange's own decision, not a legal guarantee. Tyler Moore, a cybersecurity professor at the University of Tulsa who has followed crypto for more than a decade, told CNBC leaving significant funds on an exchange is "extremely dangerous."

Moore pointed out that bank customers have FDIC insurance up to $250,000 per depositor, per insured bank. Crypto exchange customers have no equivalent. "There are no built-in protections for when these inevitable hacks take place," he said.

Ido Ben-Natan, CEO of blockchain security firm Blockaid, read the same facts differently. "I actually think no users will lose any money," he told CNBC, citing Binance's pledge to cover everything. He still expects more hacks as AI changes the security landscape, and he said the industry will come out stronger.

The breach hit Binance's offshore platform. Its regulated U.S. exchange did not have a similar issue, according to CNBC's reporting. Coinbase and Robinhood were not affected by the Binance breach, though shares of both fell Friday.

Separately on Oct. 29, prediction market Polymarket temporarily halted trading on its international exchange after a third-party data provider was hacked. At least $2.7 million was drained from users' wallets, and the company has also said it will make affected users whole.

Zhao's role

Binance co-founder Changpeng Zhao pleaded guilty in 2023 to failing to maintain an effective anti-money laundering program. He served a four-month sentence and received a presidential pardon from President Donald Trump last year.

Zhao no longer manages the exchange but remains a shareholder. He said on Oct. 29 that user funds are safe and that he expects users to fully recover their funds.

What to watch Sunday

The test comes Sunday, Nov. 1, when withdrawals are set to reopen. Binance still has to publish the full Proof of Reserves for the Oct. 31 snapshot, close out the final 10% of replacements, and release its post-mortem. How much of the roughly $3 billion frozen on-chain can be returned is also unresolved, since recovery typically requires legal process.