Binance has announced that it has replenished approximately 90% of the cryptocurrency assets stolen in a security breach that resulted in losses estimated at $6.3 billion. The exchange said it had set aside around $6.34 billion in company funds to cover the financial impact of the incident and replace the affected assets. According to the update issued on October 31, the company had increased the replenishment level from approximately 80% reported in an earlier statement to 90%. Binance said it would absorb the losses rather than pass them on to users, using its corporate treasury and portions of its Secure Asset Fund for Users (SAFU) and Futures Insurance Fund. The remaining assets account for less than 10% of the affected amount and consist of tokens with relatively lower liquidity, which may take longer to purchase in the required quantities. The company said it would continue acquiring the outstanding tokens through market and over-the-counter channels until the portfolio is fully replenished.
The incident involved unauthorised withdrawals of approximately $6.3 billion in digital assets from Binance’s platform. The exchange described the breach as a complex attack involving a compromised laptop and malicious software designed to erase evidence of its activity, complicating the investigation. Binance has been working with industry partners to locate and freeze affected assets, with approximately $3 billion identified by October 30, according to the company’s disclosures reported by Reuters. The replenishment of customer assets, however, is separate from the recovery of stolen funds. Replacing the affected tokens with company resources does not necessarily mean the stolen cryptocurrency has been returned or recovered from the attackers. The exchange has also said that it found additional points of intrusion during its investigation, following an initial indication that a compromised laptop may have been involved. Its technical investigation remains important to establishing how the breach occurred and identifying the full extent of the security failure.
Binance said ten cryptocurrencies, including Bitcoin (BTC), Ether (ETH), Tether (USDT), BNB, Solana (SOL), USD Coin (USDC), XRP, USD1, RLUSD and ZEC, were fully backed by reserves at a minimum 1:1 ratio. The company also completed a new Proof of Reserves snapshot covering assets held on its platform as of October 31. It said users holding the listed tokens would be able to independently verify the backing of their assets once the full cryptographic proof was generated. Binance estimated that producing the required zero-knowledge proofs would take approximately 40 to 50 hours and expected the complete proof to become available on November 3. The exchange also committed to restoring the SAFU fund to approximately $1 billion after using a portion of its reserves to support the replenishment process. The Futures Insurance Fund was another source of financing, with Binance stating that the remaining balance would be retained in accordance with its risk-management and regulatory requirements.
The Federal Bureau of Investigation attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit, according to Reuters. The FBI said members of the group had been observed converting stolen assets into Ethereum and warned that further laundering activity was expected. Binance has not independently confirmed the identity of the attackers, while its investigation into the breach continues. The exchange had also indicated that it remained on track to resume withdrawal services on November 1, following security checks and recovery measures, although Reuters reported that withdrawals were still unavailable at 02:50 GMT on Sunday. The incident has placed renewed attention on the security arrangements of major cryptocurrency exchanges, particularly the protection of digital asset custody systems and the ability of platforms to maintain customer access during emergencies. Binance’s decision to cover most of the reported losses with its own resources is intended to reassure users, while the remaining replenishment, withdrawal restoration and investigation findings will be important in assessing the platform’s recovery.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
