Binance restores most customer assets
Binance said it has replaced 90% of the cryptocurrency stolen in Thursday’s $6.3 billion breach. That is up from about 80% in an earlier update. The exchange said customer holdings in bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed. Withdrawals are still set to reopen Sunday, Nov. 1, according to the company.
The remaining 10% is made up of less liquid tokens. Binance said those may take longer to buy in the needed amounts. It is using public markets and over-the-counter trades, with help from industry partners. That part of the process is likely to move slower because large orders in thin markets can shift prices. The company said that slice may take longer to finish.
Company funds cover the shortfall
The replacement addresses a gap in assets backing customer balances. Binance had already set aside more than $6.34 billion in company funds, including $5 billion in the affected cryptocurrencies. Those resources were separate from roughly $3 billion in stolen assets that partners had frozen. A CoinDesk review of earlier reserve disclosures found that wallets drained in the attack were among those Binance listed as backing users’ holdings.
Binance said the replacement assets are funded through its corporate treasury and part of its futures insurance fund. A partial deployment of the Secure Asset Fund for Users, or SAFU, is expected over the next 24 hours. That fund normally covers losses from bankrupt trading positions and helps limit forced reductions in other traders’ positions. Binance said it moved only the portion above the fund’s required size and that the remaining fund still meets risk-management requirements. The exchange also committed to restoring SAFU to about $1 billion.
Investigation and proof of reserves continue
The security investigation remains open. Co-CEO Richard Teng said Friday that investigators found additional breach points beyond an initially suspected compromised employee laptop. U.S. President Donald Trump addressed the breach and said the government does not know if North Korea was behind it, adding that officials are looking into the matter. Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korea-linked hacking group.
Binance also published a new proof-of-reserves snapshot showing coverage ratios at 100% or more for the named tokens. The snapshot was taken at midnight UTC on Oct. 31. The full cryptographic proof, which would let users independently verify that their balances are included in Binance’s reported liabilities, is expected by Nov. 3. That verification step matters because it gives users a way to check the exchange’s numbers for themselves, rather than relying only on company statements.
