Cryptocurrency exchange Binance says it has replenished approximately 95% of the assets affected by last week’s roughly $6.3 billion hack, using its own financial resources to replace stolen tokens while it continues working to restore normal operations.
The remaining 5% consists primarily of less-liquid tokens that are taking longer to acquire in sufficient quantities, Binance said in a recovery update published on November 2. The exchange is purchasing those assets through both public markets and over-the-counter transactions and says customers will not be required to absorb the losses.
The announcement marks further progress following the October 29 breach, when attackers compromised Binance hot wallets at around 20:05 UTC and removed approximately $6.3 billion worth of cryptocurrency. Binance initially set aside more than $6.34 billion to cover the incident, including roughly $5 billion in the same types of tokens that had been stolen.
Coverage subsequently rose from about 80% to 90% and has now reached approximately 95%. On the basis of the exchange's $6.3 billion estimate, that corresponds to roughly $6 billion worth of affected assets having been replenished, although the dollar value can vary with cryptocurrency prices.
Binance says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed against customer balances.
The exchange took a new Proof of Reserves snapshot at 00:00 UTC on October 31 and announced Monday that the associated zero-knowledge proof had been completed. Users holding any of the ten listed assets can now use Binance's verification system to check that their balances were backed at a minimum ratio of one-to-one at the time of the snapshot.
The distinction matters: Binance's 95% figure refers to replacement of assets affected by the attack, not recovery of 95% of the cryptocurrency from the hackers.
Binance has separately said that approximately $3 billion of the stolen assets were frozen on-chain with assistance from law enforcement agencies, blockchain intelligence companies, token issuers and other industry participants. Efforts to trace and recover the remaining stolen funds are continuing.
The exchange said the final 5% of the replenishment consists of tokens outside the ten assets already covered. Because those markets are less liquid, Binance said acquiring the required quantities without disrupting trading is taking longer.
Binance plans another reserve snapshot on November 4 covering additional tokens, followed by another zero-knowledge proof. The exchange estimates the cryptographic proof will require around 40 to 50 hours to generate.
The US Federal Bureau of Investigation has formally attributed the Binance theft to North Korea, identifying the perpetrators as part of a cyber operation it tracks as TraderTraitor.
In an October 31 alert, the FBI said North Korean actors were responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29. US authorities said they had observed the attackers converting stolen assets primarily into Ethereum and expected further laundering through decentralized-finance protocols and instant-swap services.
The FBI, US Secret Service and IRS Criminal Investigation have asked exchanges, blockchain infrastructure operators and other cryptocurrency businesses to block transactions associated with addresses linked to the stolen funds.
Binance has not yet released its full technical account of how the intrusion occurred. The company has described it as a serious compromise of its hot-wallet infrastructure and says a detailed post-incident report will be published once its investigation is complete.
Withdrawals, which Binance temporarily suspended after the attack while security checks were conducted, began returning in phases on November 1. The exchange says additional networks and assets will be progressively restored as security reviews are completed.
The scale of the theft makes the incident one of the most consequential security breaches in cryptocurrency history. Binance's immediate challenge is no longer only tracing the stolen assets, but demonstrating that customer liabilities remain adequately backed as withdrawals resume.
Its latest proof-of-reserves update provides cryptographic verification for the ten specified assets. It does not, however, mean that 95% of the stolen cryptocurrency itself has been recovered: Binance is replacing the missing assets from company-controlled resources while pursuing the stolen funds separately.