Binance Resumes Crypto Withdrawals After $6.3 Billion Hack, Covers 95% of Losses

Binance is moving to restore cryptocurrency withdrawals after a record $6.3 billion security breach, with the exchange reporting significant progress in replacing stolen assets.

The incident, which occurred on October 29, 2026, has been described as the largest cryptocurrency hack in industry history.

According to the exchange's latest reported update, 90% of affected assets had been replenished by Saturday, up from approximately 80% the previous day.

Binance had also announced plans to resume withdrawals on Sunday as security checks and asset replacement efforts continued.

The latest developments follow several days of emergency measures involving the exchange, blockchain security companies and major stablecoin issuers.

Binance Uses Corporate Funds to Cover Customer Losses

Binance says customers will not bear the financial consequences of the attack, with the company committing its own resources to replace stolen cryptocurrency.

The exchange was using its corporate treasury, part of its Secure Asset Fund for Users (SAFU) and a portion of its futures insurance fund.

Binance also maintained that its futures insurance fund would remain above required risk management levels.

On Friday, the exchange reported allocating approximately $6.34 billion toward covering the losses, including $5 billion in replacement cryptocurrency assets.

However, Binance has not disclosed the exact contribution from each funding source.

Bitcoin and Ethereum Balances Fully Backed

Binance reports that customer balances in Bitcoin, Ethereum and eight additional cryptocurrencies are now fully backed.

The remaining asset shortfall primarily involves less-liquid tokens, which the exchange continues purchasing through market transactions and over-the-counter deals.

These purchases are intended to restore the affected balances without placing excessive pressure on individual trading markets.

Meanwhile, Binance has published an updated Proof of Reserves snapshot showing its reported asset holdings.

However, the complete cryptographic verification remains pending, with the exchange explaining that generating its zero-knowledge proof requires approximately 40 to 50 hours.

Blockchain security company CertiK previously requested additional information to independently verify Binance's reported replacement assets.

Until the complete proof becomes available, the exchange's replenishment figures remain company-reported rather than fully independently verified.

Industry Partners Freeze $3 Billion in Stolen Assets

The response to the attack has involved several major cryptocurrency companies coordinating efforts to restrict the movement of stolen funds.

Stablecoin issuers Tether and Circle were among the organizations that helped freeze approximately $3 billion in affected cryptocurrency.

These frozen assets are separate from the funds Binance has allocated to replace customer balances.

The distinction is important because freezing stolen cryptocurrency does not necessarily mean those assets have been recovered or returned.

Binance has not disclosed the total amount of stolen cryptocurrency successfully recovered.

The exchange's replacement strategy therefore remains separate from ongoing investigations and potential asset recovery efforts.

North Korean Hackers Linked to Attack

Blockchain intelligence company TRM Labs has attributed the $6.3 billion attack to North Korea's TraderTraitor hacking group.

The attribution follows earlier suspicions involving North Korean cybercriminal networks, although the investigation remains ongoing.

Binance's preliminary findings suggested that the attackers gained access through a compromised DevOps engineer's laptop.

The attackers allegedly accessed internal infrastructure and initiated unauthorized withdrawal transactions without directly exposing wallet private keys.

The incident has raised questions about the security of internal signing systems and operational access controls at major cryptocurrency exchanges.

For now, Binance's immediate priority remains restoring customer access, completing reserve verification and replacing outstanding assets.

Although the exchange reports substantial progress, the full technical investigation and independently verified financial impact have not yet been finalized.