Binance says it has replaced 90% of the cryptocurrency stolen in Thursday's reported $6.3 billion security breach, bringing the exchange closer to restoring normal withdrawal services. The company remains on track to reopen withdrawals on Sunday, November 1, while confirming that customer holdings of major cryptocurrencies and stablecoins are now fully backed.
The latest replenishment figure represents an increase from approximately 80% in Binance's previous update. The exchange said Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and ZEC balances are now fully backed. The remaining 10% consists mainly of less liquid tokens that may take longer to acquire in sufficient quantities. Binance is purchasing these assets through public markets and over-the-counter transactions, with support from industry partners.
In this story
2 assets
Binance said it had allocated more than $6.34 billion in corporate resources to address the shortfall, including approximately $5 billion held in the affected cryptocurrencies. These funds are separate from roughly $3 billion in stolen assets that industry partners have reportedly frozen. The exchange emphasized that customers will not bear the financial losses, stating that Binance itself will absorb the impact of the stolen funds.
The replenishment is particularly significant because the compromised wallets were among those previously disclosed by Binance as backing customer holdings. The exchange is funding the recovery through its corporate treasury, part of its futures insurance fund and a partial deployment of its Secure Asset Fund for Users, known as SAFU. Binance said it would only use the portion of SAFU exceeding its required reserve level, while committing to restore the emergency protection fund to approximately $1 billion.
Despite the progress on asset recovery, the security investigation remains ongoing. Co-CEO Richard Teng said investigators had identified additional breach points beyond an initially suspected compromised employee laptop. Meanwhile, U.S. President Donald Trump said authorities did not yet know whether North Korea was responsible and were investigating the possibility. Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a hacking group linked to North Korea.
Binance has also released a new proof-of-reserves snapshot dated October 31, showing coverage ratios of at least 100% for the listed assets. However, the exchange's full cryptographic proof, which would allow users to independently verify that their balances are included in reported liabilities, is expected by November 3.
The recovery effort marks a major step toward restoring confidence after one of the largest reported security incidents in crypto history. Nevertheless, the full reopening of withdrawals, completion of the remaining token purchases and publication of independently verifiable reserve data remain important milestones. Binance's ability to complete these steps could play a significant role in determining how quickly confidence in the exchange and the wider crypto market recovers.
