Binance says 90% of $6.3 billion hack losses are now covered, plans to resume withdrawals Sunday

retained text

Binance said Saturday that it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets in a record crypto theft announced Thursday.
Separately, the FBI said late Saturday that it has determined North Korea was responsible for the theft.
Binance said it will continue to buy the remaining relevant token assets through market and over-the-counter channels until the covered amount reaches 100% for all tokens.
"All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%," Binance said in a statement. "Binance will absorb the financial impact of these stolen funds, not our users."
The exchange said the outstanding 10% consists of tokens outside its top 10 that are "less liquid, which means they may take longer to source in the required amounts."
Binance said it is tapping its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish the assets.
"Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions," Binance said.
Its "next milestone" will be resuming withdrawal services for users by Sunday, subject to security checks, while the exchange continues its investigation into the attack, it said.
Binance declined to discuss additional details or updates on its investigation to CNBC, referring questions to its latest statement.
It still isn't clear how the attack — the largest crypto theft on record — took place.
The world's largest crypto exchange initially said the hack may involve "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." However, Co-CEO Richard Teng later said the attack involved a more complex process rather than the misuse of a single engineer's permissions.
North Korea responsible for theft
The FBI said malicious North Korean actors laundered Binance's stolen assets by converting them into Ethereum. The agency expects that the thieves will convert the digital assets as they prepare them for "further laundering stages."
TRM Labs, a blockchain intelligence and AI investigations company, had initially pointed to North Korean hackers as the culprits.
"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst," the company said.
— CNBC's Jenny Lee, Liz Napolitano and Davis Giangiulio contributed to this report.

document fetched 2026-11-01 02:56 · canonical https://cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html