Binance Values Hack-Affected Assets at $6.3 Billion and Allocates $6.34 Billion for Coverage

Key Facts

Binance valued the tokenized assets affected by the breach of its hot wallets at about $6.3 billion, after saying the breach occurred at around 20:05 UTC on October 29, 2026. The platform said it had allocated more than $6.34 billion in company funds to cover the assets through the SAFU fund and the company treasury. It said $5 billion of the allocated amount was held in the affected assets themselves, and that coverage had reached about 80% of the asset value at the time. In a subsequent update dated October 31, the share replenished rose to 90%. This progress puts asset recovery at the top of what the platform is tracking after the incident, while some affected tokens remain unrecovered.

The U.S. Federal Bureau of Investigation said on October 31 that North Korea was responsible for stealing more than $6 billion from Binance, and said the group it calls TraderTraitor carried out the activity. The bureau tracked the stolen assets as being transferred primarily to Ethereum and urged digital asset service providers to block transactions linked to the group’s addresses. This wording differs from describing the breach as having begun with a transfer of stablecoins; the bureau’s announcement identifies the primary destination of the transfers without saying the stolen assets were stablecoins. Binance estimated the impact at about $6.3 billion, while the bureau described the value of the theft as more than $6 billion. The official attribution reinforces the case’s focus on the movement of assets after the breach, alongside the platform’s handling of customer losses.

Binance said its partners had frozen about $3 billion in on-chain assets by its October 30 update, and that it had temporarily suspended withdrawals during security checks. The Associated Press reported that Tether said it had frozen funds linked to the incident worth more than $1.5 billion, while Circle said it had frozen the equivalent of more than $800 million. In its initial investigation, Binance said the incident may have involved a compromised laptop, but reported that a subsequent investigation had uncovered additional points of compromise. The company added that it had found no evidence at the time that wallet private keys had been leaked. These measures show the publicly reported aspects of the response: freezing assets, suspending withdrawals for checks, and investigating more than one possible point of compromise.

In markets, a CoinDesk report on October 29 said Bitcoin fell 4.8% to below $77,000, and Ether declined 5.7% in a snapshot published after news of the breach spread. EL7 data recorded Bitcoin’s close at $81,343.50 on October 28, then $77,991.89 on October 29 and $77,368.77 on October 30. The close was $77,582.02 on October 31, then $77,742.02 on November 1. In a separate report on the sell-off, CoinDesk reported that $1.53 billion in futures positions were liquidated over the 24 hours through October 30, including $1.29 billion in positions betting on higher prices. The Associated Press said Bitcoin fell 3.2% to below $79,000 on Thursday evening as the news spread; that market snapshot is dated differently from EL7’s daily closes.

Binance said about 10% of the assets not recovered by October 31 consisted of tokens outside the top ten listed assets, and that their low liquidity could make buying the required quantities take longer. It said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed by reserves. The company expected withdrawals to resume on Sunday, November 1, within the timeframe it had previously announced, and said full proof of reserves was expected on Tuesday, November 3, UTC. It had completed a new proof-of-reserves snapshot at 08:00 UTC+8 on October 31, estimating that producing the proofs takes about 40 to 50 hours. Binance pledged to restore the SAFU fund to about $1 billion after using part of it to cover the affected assets.

The attack comes after the 2025 Bybit breach, which the Associated Press said caused losses of $1.5 billion and was carried out by the same attackers. The agency said Binance announced on Saturday that funds allocated in the stolen assets were sufficient to cover 90% of the lost assets, while pledging to fully compensate customers. Binance said the SAFU fund was established in July 2018 to protect user assets in exceptional cases, including security breaches. The company’s stated response combines funding coverage from the fund and treasury, freezing on-chain assets, and rebuilding reserves. The next operational step the company identified is resuming withdrawals, followed by publishing full proof of reserves on the expected date.