The theft of $6.3 billion from Binance on Thursday set a grim record as the largest cryptocurrency hack in history [1]. It was more than four times larger than the previous record, a $1.5 billion heist involving Bybit in February 2025 [3]. Despite the scale of the breach, the exchange has moved to replace the missing assets using its own liquidity and reserves rather than passing the loss to its customers. By Saturday, Binance reported that 90% of the stolen assets had been replenished, an increase from 80% the previous day [1].
The recovery process relies on a mix of corporate and insurance funds. To cover the $6.34 billion total loss, Binance set aside $5 billion in the specific cryptocurrencies that were affected [1]. The remaining shortfall is being filled by pulling from the corporate treasury, a partial deployment of the Secure Asset Fund for Users (SAFU), and a portion of the futures insurance fund [2]. While the SAFU reserve is being used, the exchange committed to restoring it to its $1 billion target level [2].
Financial mechanics of the recovery
Replacing billions in digital assets without crashing market prices or depleting insurance reserves requires a specific strategy. Binance is using a combination of market buys and over-the-counter (OTC) trades to acquire the tokens it needs [1]. This approach is particularly necessary for the final 10% of the recovery, which involves less liquid tokens that are harder to source in large volumes without moving the needle on price [2].
As of the latest update, customer holdings for the major assets are fully backed. This includes $BTC, $ETH, $USDT, $BNB, $SOL, $USDC, $XRP, USD1, RLUSD, and ZEC [2]. The exchange published a reserve snapshot at midnight UTC on October 31 showing coverage ratios at 100% or more for these tokens [2]. However, the full cryptographic proof of reserves, which uses zero-knowledge proofs to allow users to verify their individual balances, is not yet available. Binance stated that generating this proof requires 40 to 50 hours of computational work and is expected by November 3 [1][2].
The recovery of funds is happening on two parallel tracks. While Binance is buying assets to make users whole, industry partners like Tether and Circle have frozen approximately $3 billion in stolen assets [1]. Tether blacklisted more than $1.5 billion in USDT, while Circle froze roughly $823 million in USDC [3]. These frozen funds are separate from the $5 billion Binance already held in its recovery pool [1]. Despite these freezes, the attacker still controls more than 420,000 ETH and 18,270 BTC, along with other tokens, totaling roughly $3.3 billion that cannot be frozen by any central authority [3].
The infrastructure breach
The attack began at 4:05 p.m. ET on Thursday. Within roughly 20 minutes, the hackers drained hot wallets across 10 different blockchains [3]. Initial investigations pointed to a compromised laptop belonging to a DevOps engineer, but CEO Richard Teng later clarified that the process was more complex. The attackers accessed a service container to submit unauthorized withdrawals, bypassing normal approval controls [3].
On the Ethereum network, the hackers utilized EIP-7702, a feature introduced in 2025 that allows standard wallets to temporarily execute smart-contract code. By using 50 pre-signed authorizations, the attacker turned a hot wallet into a "sweeper" contract [3]. Blockchain analytics firms TRM Labs and Chainalysis have attributed the activity to TraderTraitor, a hacking group linked to North Korea [2]. This group was also linked to the Bybit heist and reportedly converted 84% of those stolen funds into Bitcoin via Thorchain [3].
Binance has stated that no wallet private keys were leaked during the incident. The attacker used a self-destruct mechanism to erase the tools and digital traces used during the breach [3]. While the exchange initially focused on the compromised laptop, the investigation has since uncovered additional breach points in the signing infrastructure [3].
Reopening and security audits
The exchange paused withdrawals immediately following the theft to rebuild and test its systems. While withdrawals remained closed, deposits continued to operate normally [3]. The plan is to resume withdrawals on Sunday, November 1, starting with the Bitcoin network [2].
The decision to reopen follows a full security review and the replenishment of the most liquid assets. Binance is absorbing the entire financial impact, meaning the insurance fund must remain above required risk management levels even after the payout [1]. The futures insurance fund, which typically covers bankrupt trading positions to prevent auto-deleveraging, was tapped only for the portion that exceeded its minimum required size [2].
The market reaction to the $6.3 billion loss was relatively stable compared to previous years. Bitcoin fell about 4% to $76,400 on Friday, leading to $1.3 billion in liquidations [3]. Analysts noted that the presence of spot Bitcoin ETFs, which hold roughly 1.3 million BTC, helped prevent a more severe panic sell [3].
Regulatory and investigative response
The FBI and the U.S. Secret Service are currently coordinating with Binance on the investigation [3]. This follows previous joint efforts like Operation Atlantic, which focused on tracing stolen digital assets [3]. While blockchain analytics firms are confident in the North Korean attribution, U.S. President Donald Trump stated that the government is still "looking at that" and cannot yet confirm the origin of the attack [2].
The breach has already become a focal point for regulatory debate. CFTC Chairman Michael Selig argued that the incident supports the need for the crypto-market regulations his agency proposed earlier in the month, suggesting that offshore exchanges require more U.S. oversight [3].
Binance continues to work with industry partners to source the remaining 10% of less liquid tokens. The exchange is expected to release its full cryptographic proof of reserves on November 3 [2].
Sources
- Cointelegraph, Binance hack 90 percent replenished, https://cointelegraph.com/news/binance-hack-90-percent-replenished
- CoinDesk, Binance says it has replaced 90% of stolen crypto after massive $6.3 billion breach, https://www.coindesk.com/business/2026/10/31/binance-says-it-has-replaced-90-of-stolen-crypto-after-massive-usd6-3-billion-breach
- Decrypt, Binance hack: Everything you need to know, https://decrypt.co/382306/binance-hack-everything-you-need-to-know
Cover: panumas nikhomkhai, Pexels.
