The cryptocurrency exchange said it has replaced most lost assets and plans to restore customer withdrawals on Sunday.
Binance said Saturday that it has replaced 90% of the $6.3 billion in digital assets stolen in a massive cyberattack on Thursday, moving closer to restoring normal services for its customers.
The exchange announced it drew on its corporate treasury and several reserve pools to replace the missing funds. The latest update follows the record $6.3 billion cryptocurrency theft, which drained billions of dollars from Binance accounts across multiple blockchains in less than an hour.
Binance reiterated its pledge to make all affected users whole. “Binance will absorb the financial impact of these stolen funds, not our users,” the company said in a statement on Saturday, BBC News reported.
Replenishing funds and reopening withdrawals
Binance said it has fully covered customer balances in bitcoin, ethereum and Tether, along with seven other widely traded cryptocurrencies. The remaining 10% of lost assets could take longer to secure in the necessary quantities, according to the company.
The company has set aside more than $6.34 billion in internal funds to cover every missing token. Deposits on the platform remained unaffected throughout the incident.
The exchange’s primary operational focus is now restarting customer withdrawals, which were halted when the intrusion was discovered. Binance said it is on track to reopen withdrawals on Sunday, November 1, and will release specific timing details once they are confirmed.
How the attack unfolded
Binance said its initial inquiry pointed to a compromised engineer laptop that gave attackers access to make unauthorized transfers. A deeper review later identified additional points of breach across its systems.
Binance co-CEO Richard Teng stated in a video on X that the theft targeted the company’s hot wallet, which connects to the internet to process daily transactions. The vast majority of client funds remain secured in offline cold storage and move into hot wallets only when withdrawals take place.
Teng explained that multiple people carried out the attack using sophisticated methods, including a self-destruct mechanism designed to erase evidence and complicate the investigation. “We are working nonstop to resolve this,” Teng said, PBS NewsHour reported.
Kok Tin Gan, co-founder and chief executive of the cybersecurity firm NyxLab, said the incident appeared to stem from a single digital signature granting an attacker a never-expiring, full-access token to the hot wallet.
Investigation points to North Korean hackers
Blockchain intelligence firms have tied the theft directly to North Korea. U.S.-based analytics company TRM said it concluded with high confidence that the attack was executed by TraderTraitor, an elite North Korean hacking group also known as the Lazarus Group. TRM reported that the intruder drained about $6.36 billion from wallets across 10 blockchains, completing most transfers in roughly 20 minutes.
Jonathan Levin, co-founder and chief executive of blockchain analytics company Chainalysis, also stated on X that TraderTraitor likely carried out the heist. North Korea has routinely denied conducting cyberattacks.
U.S. President Donald Trump told reporters at the White House on Friday that federal officials are investigating the incident and examining North Korea’s potential role. The U.S. Secret Service confirmed it is coordinating with private sector partners to identify, trace and recover the assets.
Efforts to freeze and track the stolen funds
Binance said it coordinated with partner firms, token issuers and law enforcement agencies to freeze about $3 billion of the stolen crypto assets shortly after the incident.
Independent cryptocurrency analyst Garrick Hileman said evidence shows attackers have already begun laundering unrecovered funds by moving them through crypto mixers and tumblers. These mixing services blend stolen coins with other transactions to disguise their path through the blockchain.
The $6.3 billion Binance theft surpasses the prior record crypto breach, a $1.5 billion hack against the Bybit exchange in February 2025. The FBI attributed that earlier attack to TraderTraitor and North Korea. South Korea’s intelligence agency previously reported in December 2022 that North Korean cyber operatives had taken an estimated 1.5 trillion won, or about $1.1 billion, in virtual assets over a five-year period.
