EL7.AI
CryptoMediumUpdated×2•Originally published 31 October 2026•Updated 31 October 2026•
4 min read

Binance Raises Coverage of Hack Losses to 90%, Targets Full Recovery

Key Facts

1Binance raised loss coverage to 90%, from about 80% in the previous update, and is targeting 100%.
2Binance said 10 assets are now fully covered, while the remaining 10% involves less-liquid tokens.
3Binance estimated losses from the hot-wallet hack at about $6.3 billion.
4Binance targeted reopening withdrawals on November 1.
5TRM said the attacker still held assets valued at about $2.4 billion that issuers could not freeze.

Binance raised coverage of losses from the hack of its hot wallets to 90%, up from about 80% in its previous update, and said it would continue buying the remaining tokens until the full amount was covered. The update came on October 31, after the company said the hack occurred at about 20:05 UTC on October 29. Binance estimated losses at about $6.3 billion in token assets. In an October 30 update, it said it had prepared more than $6.34 billion in company funds, including $5 billion in the affected tokens themselves. The company described its announcement as coverage of the losses, while saying purchases of the remaining assets were continuing through market channels and over-the-counter trading.

Binance said 10 assets, including BTC, ETH, USDT, BNB and SOL, were now fully covered, and that the remaining 10% was concentrated in tokens outside the top 10 assets listed in its update. It added that these tokens were less liquid, which could make securing the required amounts take longer. This marked progress from the roughly 80% coverage announced in its previous update, but did not change the company’s stated goal of reaching 100% coverage for all tokens. Binance said it would continue buying the remaining assets through market channels and over-the-counter trading. It also said response funding included partial use of the SAFU fund, the futures insurance fund and company treasury, and pledged to restore SAFU to about $1 billion.

On asset tracking, Binance said its partners had frozen about $3 billion on-chain as of its October 30 update. TRM Labs, in an analysis published on October 29, estimated the value of frozen assets at about $2.7 billion, including about $2.67 billion in stablecoins frozen by issuers, along with 8,426 ETH and 74.6 million ARB frozen by the Arbitrum Security Council. Binance’s and TRM’s figures differ in their update dates and in which entity reported each estimate. TRM said the attacker still held more than 420,000 ETH and 18,270 BTC, valued at about $2.4 billion, assets the firm said were beyond issuers’ ability to freeze. According to TRM, the attacker sold USDT to market makers and borrowed ETH against USDT on Aave during the freezing attempts.

Binance said its initial investigation indicated a compromised laptop may have been involved, before a subsequent investigation uncovered additional points of compromise, and added that it had found no evidence of private wallet keys being exposed as of its update. In an independent analysis, TRM Labs attributed the attack with high confidence to TraderTraitor, which it described as a North Korean hacking unit. TRM said the attacker used an EIP-7702 delegation on Ethereum to turn a hot wallet into an automated withdrawal contract under its control, with 50 pre-signed delegations prepared. Attribution of the attack to the group remains TRM’s assessment, while Binance did not identify the attacker in its update. The incident follows the February 2025 hack of Bybit, which caused $1.5 billion in losses; the FBI said North Korea and the TraderTraitor group were responsible.

In a market reaction, bitcoin fell 3.2% on the evening of Thursday, October 29, to below $79,000, according to the Associated Press. On October 30, bitcoin hit a six-week low of $76,368, while ether reached a two-month low of $2,178 before markets steadied, according to a Reuters report published via Euronext. The report added that BNB fell about 6.4% in 24 hours to $696. It also said Coinbase, Strategy and Robinhood shares declined in that day’s trading, without specifying the declines in the published excerpt. Reuters put the scale of the incident in the broader context of digital asset hacks, saying about 150 incidents involving cryptocurrency theft worth $2.9 billion occurred in 2025.

Withdrawals remained temporarily suspended in the October 31 update, while Binance said deposits and other unaffected services continued to operate. The company targeted reopening withdrawals on Sunday, November 1, subject to security reviews. It had also announced a new proof-of-reserves snapshot at midnight UTC on October 31. Binance estimated that producing the full proof would take 40 to 50 hours and that it would be available by November 3. In addition, the company said it expected to share further technical findings within about 48 hours after verification, followed by a report explaining what happened, the lessons learned and additional security measures.