Binance Says It Has Replenished 90% of Assets Stolen in Record $6.3 Billion Hack

Binance said on Saturday that it has replaced 90% of the roughly $6.3 billion in cryptocurrency taken from its hot wallets earlier in the week, in what Reuters, via Channel NewsAsia, described as the largest crypto theft on record. The exchange said it used company funds to buy replacement tokens and pledged to cover the remaining balance, though it gave no firm date for when that work would be finished.

What Binance Said

According to CNBC, Binance confirmed Saturday that it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets, in a theft the outlet called the largest crypto heist on record. Reuters, carried by Channel NewsAsia, reported the exchange said it was able to replace 90% of the stolen amount by using company money to buy new tokens.

Co-CEO Richard Teng addressed the update directly on X, as cited by Channel NewsAsia: "We've now replenished 90 per cent of the stolen assets, and we're committed to covering the remaining 10 per cent. Our users will not bear the financial impact of this incident."

The Remaining 10%

Available reporting does not identify which specific tokens make up the unresolved balance. Per CNBC, the exchange said the outstanding 10% consists of tokens outside its top 10 holdings that are "less liquid, which means they may take longer to source in the required amounts." Channel NewsAsia's Reuters report carried a nearly identical description, noting those tokens "may take longer to buy."

Neither outlet's reporting includes a concrete restoration date. CNBC reported that Binance said it will continue buying the remaining token assets through market and over-the-counter channels "until the covered amount reaches 100% for all tokens," without specifying a timeline. That framing suggests an open-ended process tied to market liquidity for the affected tokens rather than a fixed deadline.

How the Funds Are Being Sourced

CNBC reported that Binance is tapping its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish the assets. Channel NewsAsia's Reuters account added detail on SAFU, describing it as a bitcoin reserve the exchange holds to protect customers in the event of security breaches, and reported that Binance has set aside around $6.34 billion of company funds internally to cover the losses.

Our calculation: comparing the two reported figures, the 90% replenished against the 10% still outstanding, leaves a gap of 80 percentage points (90 minus 10). This is simple arithmetic on the two reported percentages and not a projection of how quickly the remaining assets will be sourced.

Attribution of the Attack

Channel NewsAsia reported that crypto prices fell on Friday as Binance, described in that report as the world's biggest crypto exchange, sought to reassure customers their funds were safe after losing more than $6 billion worth of crypto in a hack that analysts blamed on North Korea. The attribution in that reporting is an analyst assessment rather than an official or confirmed finding, and the report does not name the firms behind it.

Binance's own account of how the breach occurred has evolved. CNBC reported that the exchange initially said the hack may have involved "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Teng later described a more complex process. Channel NewsAsia quoted him saying the breach was a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate.

Proof-of-Reserves Snapshot

Channel NewsAsia reported that Binance also said it had taken a new snapshot of assets held on its platform as of 0000 GMT on October 31, as part of its proof-of-reserves process.

What's Missing From the Record So Far

Available reporting does not include comment from regulators or major counterparties, such as custodians or other exchanges, on Binance's replenishment update. CNBC noted that Binance declined to discuss additional details or updates on its investigation when asked, referring questions back to its posted statement. No outlet in this reporting set names the specific less-liquid tokens still outstanding; the public record centers on the 90% coverage figure, Teng's commitment to reach 100%, and the funding sources behind the buyback.

Bottom Line

Binance has told the public, through its own statement and confirmed by CNBC and Reuters via Channel NewsAsia, that it has replaced 90% of the $6.3 billion lost in the hack using SAFU reserves, part of its Futures insurance fund, and corporate treasury money, with Co-CEO Richard Teng pledging users won't absorb the financial hit. What remains unresolved in the public record is the identity of the illiquid tokens still being sourced, a firm timeline for closing the final 10%, and any independent confirmation from regulators or counterparties, leaving the story dependent on further disclosures from Binance itself.