Binance $6.3B Hack: '90% Replenished' Means Bought Back, Not Recovered

Binance has promised that users won't pay for the $6.3 billion theft. What backs that promise is not its $1 billion user protection fund but the company's own treasury.

Binance says it has replenished 90 percent of the roughly $6.3 billion stolen from its platform in the largest crypto theft on record, and that it will cover the rest. The word doing the work there is "replenished." Binance has not clawed most of the money back from the hackers. It has spent its own money buying replacement tokens on the open market to refill the wallets that were drained.

That distinction matters for anyone judging what this incident says about keeping assets on a centralized exchange. By Binance's account, users are being made whole. But the thing protecting them is not a recovery process or an insurance policy. It is the balance sheet of the world's largest exchange.

Replenished is not recovered

CNBC put it plainly: covering 90 percent of the stolen token assets "doesn't mean it has recovered 90% of the funds from the attacker." Binance says the outstanding portion consists of less liquid tokens that may take longer to source in the required amounts. By Sunday, a Reuters report carried by The Korea Times put the coverage figure at 95 percent.

Recovery runs on a separate track. Binance says it has frozen approximately $3 billion of the stolen assets with help from law enforcement and analytics firms. The FBI has attributed the attack to TraderTraitor, a North Korean state-sponsored unit, and says its members have been converting the stolen assets into ether, with more laundering expected. North Korea has denied involvement.

If frozen funds are eventually returned, they would presumably flow back to Binance, which has already paid to replace them. Binance hasn't spelled that out, but it follows from the order of events: the exchange absorbed the loss first and is chasing the thieves second.

Co-CEO Richard Teng's message to customers was short: "Our users will not bear the financial impact of this incident."

A $1 billion safety fund meets a $6.3 billion loss

Binance says it has reserved more than $6.34 billion of company funds to cover the losses, including $5 billion already held in the affected cryptocurrencies. Part of the money came from its Secure Asset Fund for Users (SAFU), a $1 billion reserve meant for exactly this kind of event. The rest came from a portion of its futures insurance fund and from the corporate treasury.

SAFU is the useful reference point. Back in 2019, hackers took more than 7,000 bitcoin from Binance, worth over $40 million at the time, and the exchange pointed to SAFU as its emergency fund for such eventualities. Today's $1 billion fund would cover a loss of that size many times over. Against this one, it covers about a sixth.

The previous record was the $1.5 billion theft from Bybit in 2025, and CNBC notes that several features of this attack match earlier North Korea-linked heists including Bybit. The size of the biggest theft has roughly quadrupled in about a year and a half. The fund set aside specifically for customers has not kept pace, so the bill landed on the treasury.

The hot wallet that was also a reserve

Teng has stressed that the attack hit Binance's hot wallet, the internet-connected account used to process withdrawals, rather than customer funds. In a narrow sense that is accurate: no customer's displayed balance went down.

But CoinDesk, examining Binance's reserve data, found that the compromised wallets were previously included in a list detailing assets backing customer balances. Put simply, the coins that disappeared were part of what stood behind the numbers users see in their accounts. Balances stayed the same while the backing shrank. Replenishment is the work of closing that gap.

That is why the next document Binance publishes matters more than this weekend's statements. The exchange says it took a new snapshot of platform assets as of 0000 GMT on October 31 and plans to publish its proof of reserves on Monday. Holders of the listed tokens are supposed to be able to verify that their assets are backed at least 1:1. Until then, the 90 and 95 percent figures are Binance's own numbers, unaudited by anyone outside the company.

How the attackers got in is still unclear

Binance first pointed to a compromised DevOps engineer's laptop. Teng later said investigators had found additional breach points and had not yet pieced together the full sequence of events. According to CoinDesk, the attackers used a self-destruct mechanism to erase evidence and exploited Ethereum's EIP-7702 account-delegation feature to take control of a hot wallet without going through Binance's normal approval procedures.

EIP-7702 lets an ordinary Ethereum account delegate its behavior to smart contract code. If that is how the approval process was sidestepped, the problem is not unique to Binance. Any custodian whose signing policies were designed before account delegation existed has reason to re-check them. Binance says it is reviewing its cloud systems, employee devices, private-key management and transaction-signing procedures.

Withdrawals return in phases

Withdrawals were suspended after the hack. Binance said it would begin restoring them on Sunday, November 1, between 0600 and 0900 GMT, starting with bitcoin, ether, BNB, Solana, XRP, dogecoin and other major tokens, with remaining assets and networks to follow. Deposits stayed open throughout.

What this shows, and what it doesn't

The case for Binance is simple. Very few companies could absorb a $6.3 billion loss within days and still promise that customers won't pay for it. That is a real form of customer protection, and plenty of exchange failures have ended far worse for users.

The limits are just as plain. This protection rests on one company's size and willingness, not on a rule or an outside insurer. A smaller exchange hit by the same attackers could not make the same promise, because no fund sized for this risk exists anywhere in the system. And the figures that matter most, how much has been replenished and whether reserves cover balances, stay self-reported until the proof-of-reserves report is out and has been picked apart.

Binance has turned a security failure into a show of financial strength. Whether that rebuilds trust depends on Monday's numbers, and on what the investigation eventually says about how so much value came to sit in wallets an attacker could reach.

Search This Blog

Omni Topic - Tech