Binance Restores 90 Percent of $6.3 Billion Hack Losses

A $6.3 billion cryptocurrency theft has prompted Binance to replenish customer assets and strengthen security measures after attackers breached the world's largest cryptocurrency exchange on Thursday. The company said October 31, 2026, that it had restored backing for approximately 90% of the stolen assets and expected to reopen withdrawals on Sunday, pending final security checks.

The recovery effort involves replacing the stolen tokens rather than retrieving 90% of the funds from the attackers. Binance said it would continue purchasing the outstanding assets through cryptocurrency markets and over-the-counter transactions until every affected token was fully backed.

According to Binance, its major cryptocurrencies, including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC, have already reached 100% backing. The remaining 10% consists primarily of less liquid tokens outside its top 10 assets, which could take longer to acquire in sufficient quantities.

The exchange is financing the replenishment through several internal resources, including its Secure Asset Fund for Users (SAFU), part of its Futures insurance fund, and its corporate treasury.

Binance emphasized that customers would not bear the financial consequences of the incident.

"All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%." Binance said in a statement.

The company also addressed responsibility for covering the stolen assets.

"Binance will absorb the financial impact of these stolen funds, not our users." Binance said.

The exchange acknowledged that some remaining tokens would require additional time to source because of limited market liquidity.

"Less liquid, which means they may take longer to source in the required amounts." Binance said.

Binance described the replenishment effort as an ongoing financial commitment backed by concrete measures.

"Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions." Binance said.

The company identified the reopening of customer withdrawals as its immediate operational priority.

"Next milestone." Binance said, referring to its planned restoration of withdrawal services by Sunday.

The investigation into the breach remains unresolved. Binance initially suggested that a compromised development operations engineer's laptop might have provided attackers with access to a service container and enabled unauthorized withdrawal transactions.

"A compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Binance initially said.

Co-CEO Richard Teng subsequently indicated that the incident involved a more complicated attack process rather than the misuse of one employee's permissions. The exchange has not established publicly how the attackers executed the entire operation.

Blockchain intelligence and investigations company TRM Labs identified possible connections to North Korean hacking groups. Its assessment cited similarities with earlier cryptocurrency thefts, including attacks involving Bybit and KelpDAO in April 2026.

TRM Labs highlighted suspicious funding movements, advance preparation, and transaction signatures obtained before the theft as indicators supporting its assessment.

"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst." TRM Labs said.

The Washington Post reported that the attackers stole the cryptocurrency within minutes on Thursday, triggering an industry-wide effort to freeze billions of dollars in stolen digital assets. Binance has not publicly confirmed the perpetrators, and the investigation remains ongoing.

Withdrawal services are scheduled to resume Sunday, subject to security verification and final confirmation from Binance.