Binance says it has covered about 90% of the approximately $6.3 billion in token assets stolen from its hot wallets, and plans to make users whole for the remaining losses.
The exchange announced Saturday that it will continue sourcing the outstanding assets through market purchases and over-the-counter transactions. The theft, disclosed Thursday, is the largest crypto heist on record.
Follow THE FUTURE on LinkedIn, Facebook, Instagram, X and Telegram
Binance Says Users Will Not Bear The Loss
Binance said its largest token holdings—including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC—are fully backed. The remaining shortfall involves tokens outside its top 10 holdings, which the company described as less liquid and potentially harder to acquire in the required quantities.
“Binance will absorb the financial impact of these stolen funds, not our users,” the exchange said in its statement.
To replenish the assets, Binance said it is drawing on its Secure Asset Fund for Users, a portion of its futures insurance fund and its corporate treasury. The company said it would continue reporting progress and taking steps to cover the full financial impact.
Withdrawals Could Resume As Investigation Continues
Binance identified the resumption of user withdrawals as its next milestone, saying services could return by Sunday, subject to security checks. The exchange said its investigation into the attack remains ongoing.
Binance declined to provide further details about the investigation, referring questions to its latest public statement.
How The Breach Happened Remains Unclear
The precise mechanics of the attack—and who carried it out—have not been established publicly. Binance initially said the breach may have involved a compromised DevOps engineer’s laptop, which could have enabled an attacker to access a service container and submit unauthorized withdrawal transactions. Co-CEO Richard Teng later said the incident involved a more complex process than the misuse of a single engineer’s permissions.
Blockchain intelligence firm TRM Labs has pointed to North Korean hackers as potential perpetrators. The firm said the attack shared characteristics with earlier heists it has linked to North Korea, including activity involving Tornado Cash, advance staging and signatures obtained before the theft and executed in a concentrated burst. Those observations are indicators, not a confirmed attribution.
For Binance, the immediate test is operational as well as financial: restoring access to withdrawals while demonstrating that the stolen assets are being replaced and that its security controls can withstand scrutiny.
