Binance says it has replaced about 90% of the assets stolen in Thursday's hack and is still working to source the remaining amount. The stolen assets were valued at about $6.3 billion. The exchange says it plans to resume user withdrawals on November 1. Binance has pledged to cover the full loss and says it has allocated more than $6.34 billion in company funds for compensation, leaving user assets unaffected by the loss.
Binance used company funds to cover most of the loss
Binance said it used several funding sources, including company reserves, to replace the stolen assets. The coverage includes Bitcoin, Ethereum, Tether and seven other actively traded cryptoassets. The company said it may take longer to source the remaining assets in the required currencies and amounts.
Replacing assets and reopening withdrawals are separate steps for exchange users. Binance said its next goal is to restore withdrawal services and that the process remains on track for November 1. It will provide further details once arrangements are confirmed. The timing for a full return to service will depend on information Binance has yet to confirm.
Investigation finds additional points of intrusion
Binance's initial investigation indicated that an engineer's laptop had been compromised, leading to unauthorized withdrawals. The company later revised its findings, saying it had identified “additional intrusion points.” Co-CEO Richard Teng said more than one attacker was involved and that they used sophisticated methods to cover their tracks, including “self-destruct mechanisms.” The investigation is ongoing, and details released so far do not fully explain how the attackers obtained the relevant access.
Binance has said it froze about $3 billion in stolen assets with help from law enforcement, intelligence agencies and partners. The U.S. Secret Service has also said it is working with private-sector partners to trace, freeze and recover the funds. Frozen assets do not amount to a full recovery of the loss; how much more can be retrieved will depend on the investigation.
Loss would exceed the Bybit theft
At the amount currently disclosed, the incident is believed to be potentially the largest crypto hack to date, surpassing the roughly $1.5 billion stolen from the Bybit exchange in 2025. The U.S. Federal Bureau of Investigation previously attributed the Bybit theft to North Korea, which has denied involvement in such attacks.
Two blockchain analytics firms said they had strong intelligence indicating that the North Korea-backed Lazarus Group, also known as TraderTraitor, may be linked to the Binance incident. The exchange's investigation is still underway, however, and attribution has not been established as a final conclusion. Users continue to focus on the value of assets involved, the funds frozen and the progress toward restoring withdrawals.