Binance says it has allocated enough resources to absorb October’s $6.34 billion cryptocurrency hack. On November 12, Binance said it had completed coverage of affected assets. Its November 4 update reported approximately 98% token replenishment.
The exchange had earmarked more than $6.34 billion from its own resources. That funding supports its pledge that customers will not carry the theft’s financial burden. Funding alone did not establish that every stolen token had been replaced. Binance said its remaining purchases involved less-liquid cryptocurrencies obtained through markets and private trades.
Binance Widens Reserve Checks After Covering Losses
On October 30, Binance reported covering roughly 80% of impacted token holdings. It raised that figure to 90% on October 31 and 95% by November 1. By November 4, the company said the replacement rate reached approximately 98%. On November 12, Binance said it had completed coverage of the affected assets.
Its November 4 proof-of-reserves snapshot included 44 tokens, compared with ten previously. The original ten included BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Binance completed cryptographic verification for those ten tokens on November 2. Users could therefore verify that the snapshot backed their listed balances. That verification does not establish that attackers returned the stolen cryptocurrency. Its November 12 proof-of-reserves snapshot covered 198 tokens. Binance said the full zero-knowledge proof would take about 40 to 50 hours to generate, after which users could verify their balances.
The exchange identified three funding sources for replacement purchases. These included its corporate treasury, part of its SAFU reserve, and its futures insurance fund. Binance pledged that any remaining replacement gap would not become a customer loss.
FBI Attributes Theft to North Korean Group
The breach occurred on October 29, with unauthorized transfers from several Binance hot wallets. The FBI attributed the theft to North Korea’s TraderTraitor operation on October 31. North Korea has denied involvement, according to reporting on November 3. The FBI urged blockchain services to block addresses linked to the stolen funds.
Binance’s preliminary investigation described a campaign involving fake job interviews and compromised internal software. Attackers reached a wallet-signing service and triggered transactions outside the usual withdrawal pathway. They also abused Ethereum’s EIP-7702 permissions, complicating efforts to stop unauthorized transfers.
Binance said it later revoked those permissions and rebuilt affected systems. In its November 3 account, Binance valued frozen or intercepted assets at about $2.85 billion. Chainalysis also traced funds across several networks and linked the attack to TraderTraitor. Its analysis identified rapid swaps involving $325 million in stablecoins.
What remains after the funding pledge
Binance said it would continue reopening withdrawals in phases. The next checks are the full proof for its November 12 reserves snapshot and the findings of an independent security review. The exchange did not provide a date for completing all withdrawal reopenings or the review.
Disclaimer: This report is for information only, not investment advice; confirm current withdrawal availability and reserve data directly with Binance.
