Binance Restores Coverage for 95% of Tokens Affected by $6.3 Billion Hack
Key Facts
Binance co-CEO Richard Teng said on November 3 that the platform had restored coverage for 95% of the tokens affected by the previous week’s hack, which the company estimated at about $6.3 billion. Reuters quoted Teng as saying customer losses were covered by the SAFU reserve fund and other company funds set aside for that purpose. The statement thus combined the restoration of affected balances with the company bearing the cost of the losses, while a portion of the affected tokens remained under recovery. Teng said, "We take responsibility for that." Reuters described it as potentially the largest financial theft ever.
Binance said in its official update on November 1 that it had covered about 95% of the affected amount, up from 90% in its previous update. In an update on November 2, it said the remaining portion, about 5%, included tokens outside the 10 largest assets listed in its statement. The company said those assets were less liquid and that sourcing the required quantities would take longer. This means recovery of the remaining portion depends on finding those tokens in the necessary quantities, according to Binance’s explanation. Teng described the progress on November 3 as having restored coverage for 95% of the affected tokens.
Net customer outflows reached $4.72 billion through Monday, November 2, equivalent to about 3% of the platform’s assets, Reuters reported. Most of the outflows were in USDT. Teng said hourly inflows and outflows had returned "almost to normal." This came after billions of dollars in net outflows, as Binance resumed services in stages following the incident. The statement did not specify the amount of inflows and outflows after they returned to near-normal levels.
Binance said it had more than 335 million users worldwide and that average daily trading volumes across digital assets and derivatives stood at $95 billion. The company gave these figures on November 3 as it dealt with the fallout from the hack and restored coverage for the affected tokens. In its initial announcement about the incident, it said its preliminary investigation indicated that a DevOps engineer’s laptop may have been compromised, and that it had found no evidence of private wallet keys being leaked. It added that its partners had helped freeze about $3 billion of the affected assets on-chain, and that losses would be covered by the SAFU fund and company funds. These details provide context for the platform’s announcement about the source of loss coverage and its initial measures after the incident.
The Federal Bureau of Investigation attributed the attack to North Korean hackers, while Pyongyang denied involvement, according to the Associated Press. On next steps, Teng said Binance would publish a post-incident review "in due course," without specifying a date. In its update dated November 3, the company said it would gradually reopen withdrawals for more assets starting at 12:00 UTC+8, subject to passing security and readiness checks. It said deposits were operating normally as withdrawals resumed, and that it would gradually add other assets after completing the checks. It also said it planned to take a new proof-of-reserves snapshot on November 4 to include additional tokens, and estimated that preparing the updated zero-knowledge proof would take about 40 to 50 hours after the snapshot.