Binance Raises Coverage of Hack Losses to 90% of More Than $6.34 Billion
Key Facts
Binance has raised coverage of assets affected by the hack to 90%, from about 80% in its previous update, according to a statement published on October 31. The company said it had allocated more than $6.34 billion of its own funds to cover the losses and was still buying the remaining tokens. This means financing the financial impact on the affected assets; it does not mean recovering 90% of the coins seized by the attacker. TRM Labs estimated that about $6.36 billion was transferred from Binance wallets to addresses controlled by the attacker across 10 blockchains. Most transfers began at 20:05 UTC on October 29, and most lasted about 20 minutes.
The remaining 10% of coverage relates to tokens outside the list of 10 assets Binance fully covered, the company said. It said those tokens were less liquid, which could extend the time needed to buy the required quantities. This means completion of the funding depends on finishing purchases of those assets, after overall coverage reached 90%. The update did not specify when the purchases would be completed. This measure remains separate from recovering coins from addresses controlled by the attacker.
Binance said the replenishment funding included part of its SAFU fund, its futures insurance fund and the company treasury. It pledged to replenish SAFU until its size returns to about $1 billion, after using part of it in response to the incident. In an earlier update, the company said its partners had helped freeze about $3 billion of affected assets on-chain. It also told the Associated Press it had begun recovering user assets and had set aside more than $6.34 billion of company funds to cover the stolen assets. The combination of freezing and funding reflects two different tracks: limiting the movement of some assets and covering losses financially.
On system security, Binance said its initial investigation indicated that a DevOps engineer's laptop may have been compromised, and that it had found no evidence of wallet private keys being leaked. In a later update, it added that the investigation had uncovered additional points of compromise, after the initial assessment had pointed to a possible laptop breach. TRM Labs estimated that preparations for the attack began at least 36 hours before the theft. The firm attributed the attack, with high confidence, to North Korea's TraderTraitor group, based on on-chain and off-chain information. Asked about possible North Korean involvement, U.S. President Donald Trump said U.S. officials were looking into it.
TRM Labs placed the hack in the context of the $1.5 billion Bybit theft in February 2025, saying the Binance incident was about four times larger and the biggest recorded cryptocurrency theft. U.S. authorities had attributed the Bybit attack to North Korea and the TraderTraitor group, according to the Associated Press. The comparison provides a measure of the funds that left Binance wallets, without meaning that this amount was recovered or fully frozen. Binance had said about $3 billion of affected assets were frozen in cooperation with on-chain partners. The platform's funding for the losses remains a separate measure from the fate of assets still under the attacker's control.
For proof of reserves, Binance took a new snapshot on October 31 at 00:00 UTC. The company estimated that generating the full proof would take 40 to 50 hours because of the computational burden, and that it would be available by November 3. It said holders of the 10 covered assets would then be able to independently verify that their balances were backed at a ratio of at least 1:1. This is part of the verification steps the platform announced after the hack, while it said it had temporarily suspended withdrawals to conduct security checks. Proof of reserves is intended to show that customer balances are covered, while the company continues to buy lower-liquidity tokens to cover the remaining share.
Binance is targeting a resumption of withdrawals on Sunday, November 1, according to its update, and said it would provide more information after confirming the details. It had kept deposits and other unaffected services available during the withdrawal suspension, according to its earlier statement. In market trading, the Associated Press said bitcoin fell 3.2% on the evening of Thursday, October 29, to below $79,000. The agency's report did not specify the timing of the move relative to the hack. The resumption of withdrawals remains the next operational milestone announced by the platform, with a further update to follow after details are confirmed.