Binance Says It Has Replenished 98% of Assets Lost in $6.3 Billion Hack; Coinbase Details Its Cold Storage Setup

Since hackers drained roughly $6.34 billion from Binance on Oct. 29, the story has moved from the theft itself to the cleanup and to the question every other exchange now faces: could this happen to us?

Binance said Wednesday, Nov. 4, that it has replenished 98% of the affected assets using its own resources. It also expanded its proof-of-reserves coverage to 44 cryptocurrencies.

The company has promised customers full reimbursement from the start. On Oct. 31, co-CEO Richard Teng said Binance had reassigned tokens and funds on hand to cover 90% of the stolen value. He said the remaining 10% were less liquid tokens that could take longer to buy back.

How the money is being covered

Binance said the shortfall would come from its Secure Asset Fund for Users, known as SAFU, which held about $1 billion in bitcoin. It also named its Futures Insurance Fund and corporate treasury. The company said it intends to rebuild SAFU to roughly $1 billion.

At the outset, Binance said it had worked with blockchain partners to freeze about $3 billion of the stolen assets on-chain. That left roughly half the total still out there at the time. Chainalysis, one of the firms tracing the funds, said the rest was still moving across multiple blockchains, including bitcoin and ethereum. In its Nov. 3 incident findings, Binance put the affected assets at approximately $6.34 billion and said around $2.85 billion had been frozen or intercepted, subject to reconciliation and market prices.

Binance said Oct. 31 it was on track to reopen withdrawals on Nov. 1. It halted deposits and withdrawals right after the breach.

What Binance says happened

Binance's initial account points to a compromised laptop belonging to a DevOps engineer. That gave an attacker access to a service container, from which unauthorized withdrawal transactions were submitted.

The exchange said it has found no evidence of any wallet private key leak. Teng called it a "complex attack" and said malicious software was designed to delete evidence of its own activity, which makes tracing harder.

In its Nov. 3 findings, Binance described a campaign involving fake recruitment interviews, compromised developer software and an internal AI tool before attackers reached wallet-signing operations. It said malicious Ethereum authorizations allowed further transfers independently of its normal withdrawal infrastructure, and that suspending withdrawals and shutting down hot-wallet services did not automatically cancel permissions already established on-chain. Binance has promised a detailed technical post-mortem once the investigation is complete and the facts are verified.

FBI points to North Korea

The FBI said Oct. 31 that a North Korean actor it tracks as "TraderTraitor" was behind the theft. The bureau said it had observed the group converting the stolen assets into other cryptocurrencies, mostly ethereum. It expects further laundering.

The FBI asked private-sector virtual asset service providers to block transactions linked to known TraderTraitor actors and published a list of associated addresses. The same group was behind the roughly $1.5 billion Bybit hack last year, according to the bureau.

TRM Labs and Singapore-based Pangolin Intelligence also pointed to North Korea, and Chainalysis said it had high confidence in that attribution. Binance has said it is working with law enforcement partners to confirm the identity of the attackers.

Coinbase says it was not touched

Coinbase put out its own security update Wednesday. The publicly traded exchange said its systems and customer funds were unaffected by the Binance breach.

The company said more than 99% of customer assets are in cold storage. It keeps a limited balance in internet-connected hot wallets to process withdrawals and moves excess funds offline.

Coinbase described several safeguards:

• Private keys are split into pieces and never reassembled in full, even during signing.
• Production changes require approval from multiple employees, and no single employee has standing access to the wallet signing service.
• Withdrawal limits and anomaly detection can interrupt suspicious transfers.
• Kill switches can halt signing entirely, and a compromised system cannot resume until investigators clear it.

Coinbase said customer assets are held 1:1, remain customer property and are not lent without customer instruction. As of Sept. 30, it reported $377 billion in platform assets, $8.6 billion in cash and equivalents and $2.2 billion in crypto held for investment.

The limits of the reassurance

Coinbase's own published disclosures set boundaries on that message. Its crime insurance covers only a portion of digital assets and excludes losses from someone accessing a personal account with stolen credentials. The company says losses from a covered event could exceed what insurers pay.

For U.S. customers, crypto holdings carry no FDIC or SIPC protection. Cash balances may qualify for pass-through deposit insurance up to $250,000 per depositor, depending on conditions.

Coinbase has also had its own security failure. A 2025 customer data breach was estimated to potentially cost the company up to $400 million.

The 99% cold-storage figure is self-reported, and the precise allocation has not been independently established by third parties. Coinbase's SOC 1 Type II and SOC 2 Type II examinations provide assurance about the controls within their assessed scope, but they do not independently establish that every customer asset is protected against theft.

Open questions

Binance co-founder Changpeng Zhao pleaded guilty in 2023 to failing to maintain an effective anti-money-laundering program. He served four months in prison and received a pardon from President Trump last year. Binance was co-founded in 2017 with Yi He, who announced the withdrawal suspension on X.

The next concrete marker is Binance's technical post-mortem, which the company has not dated. It will show how an attacker moved from one engineer's machine to a service able to submit withdrawals. With laundering expected to continue, the portion of the stolen funds still moving remains the open problem for investigators.