Binance said it has replaced about 90% of the cryptocurrency stolen in Thursday’s $6.3 billion breach. The exchange expects to reopen withdrawals on Sunday, Nov. 1, according to its latest update. That replacement figure is up from roughly 80% in an earlier statement.
Customer balances are covered
Binance said customer holdings in bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed. The remaining 10% is mostly less liquid tokens. Binance said those assets may take longer to buy in the needed amounts. It is using public markets and over-the-counter trades, and it is working with industry partners to finish the purchases.
The exchange had already set aside more than $6.34 billion in company funds, including $5 billion in the affected cryptocurrencies. Those resources were separate from about $3 billion in stolen assets that partners had frozen. Binance said it will absorb the financial impact rather than pass it to users. That matters because the hack created a shortfall in assets backing customer balances. A CoinDesk review of earlier reserve disclosures found that wallets drained in the attack were among those Binance listed as backing user holdings.
Treasury and SAFU funds used
Binance said the replacement assets are funded through its corporate treasury and part of its futures insurance fund. A partial deployment of the Secure Asset Fund for Users, or SAFU, is expected over the next 24 hours. SAFU normally covers losses from bankrupt trading positions and helps limit forced reductions in other traders’ positions, known as auto-deleveraging. Binance said it moved only the portion above the fund’s required size and that the remaining fund still meets risk-management requirements. The exchange also committed to restoring SAFU to about $1 billion.
The security investigation is still open. Co-CEO Richard Teng said Friday that investigators found additional breach points beyond an initially suspected compromised employee laptop. U.S. President Donald Trump addressed the breach and said the government is looking at whether North Korea was involved. Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korea-linked hacking group.
Proof-of-reserves update
Binance also published a new proof-of-reserves snapshot. It shows coverage ratios at 100% or more for the named tokens, taken at midnight UTC on Oct. 31. The full cryptographic proof, which would let users independently verify that their balances are included in Binance’s reported liabilities, is expected by Nov. 3. For now, the exchange says the core shortfall is nearly closed. The remaining purchases, perhaps, will be the harder part to judge.
