Binance says it has now replaced 90% of the crypto stolen in its record $6.3 billion hack, up from 80% a day earlier. CoinDesk reported the update on October 31, and outlets including the BBC, CoinMarketCap and bloomingbit picked it up as the exchange held to a plan to reopen withdrawals on Sunday, November 1, 2026.
The headline number sounds like a clean ending. It is not one yet. Binance has said the loss will fall on the company and not on customers, but the last 10% is still unfilled, the exchange’s proof of backing is still being generated, and the attacker still controls a large pile of coins.
This analysis walks through what Binance has confirmed, how the money was drained, who froze what, and what the episode means for exchange security. It builds on our earlier look at the $6.34 billion reserve Binance set aside, and it flags every place where outlets disagree.
What Binance Said About Covering 90% of Losses
According to CoinDesk, Binance told users it had replenished 90% of the roughly $6.3 billion in stolen assets. Cointelegraph and bloomingbit both describe the figure as a 10-point jump from 80% the day before. Binance’s message was consistent across outlets: the company, not its users, absorbs the financial hit.
Co-CEO Richard Teng made that point on X on Saturday, according to wire reports carried by The Edge Malaysia and TV5. Co-founder Yi He had said the same thing in the first hours after the breach, based on the timeline compiled by CryptoTicker. In both cases the pledge was the same. Users keep their balances, and Binance pays for the gap.
The wording matters because “covers 90% of losses” can be read two ways. Binance did not repay users out of a legal settlement or an insurer. It bought replacement tokens with company money and moved them back into the wallets that back customer balances. The 90% figure therefore measures how much of the stolen inventory Binance has re-acquired, not how much cash has reached individual accounts.
The BBC, as cited in the topic coverage, framed the story as a crypto firm covering 90% of losses after a $6.3 billion hack. That framing is accurate on the numbers Binance has published. It leaves out the open items covered below, including the unverified proof and the 10% of tokens that are harder to buy.
How Binance Funded the $6.34 Billion Reserve
Reuters-style reports carried by outlets such as The Edge Malaysia say Binance set aside about $6.34 billion of company funds to cover the losses. CoinDesk adds that about $5 billion of the affected cryptocurrencies came from company funds. The money came from three pools, per CoinDesk and Cointelegraph.
| Funding source | Role in the recovery | Reported by |
|---|---|---|
| Corporate treasury | Main pool used to buy replacement tokens | CoinDesk, Cointelegraph |
| SAFU (Secure Asset Fund for Users) | Partially deployed within 24 hours | CoinDesk |
| Futures insurance fund | A portion used toward the gap | CoinDesk, Cointelegraph |
| Total set aside | About $6.34 billion of company funds | The Edge Malaysia, Cointelegraph |
| Affected cryptocurrencies funded | About $5 billion | CoinDesk |
The mix is a signal. SAFU exists for exactly this kind of event, yet Binance only deployed part of it and leaned on the corporate treasury for the bulk. Tapping the futures insurance fund means some of the cushion that protects derivatives traders also went toward a spot-side theft.
Binance has not published an itemized ledger of how many dollars came from each pool, and the fact sheet behind this report does not include one. Treat any per-pool split you see on social media as unconfirmed.
Which Tokens Are Fully Backed and What the Last 10% Means
CoinDesk lists ten assets Binance says are completely backed again: Bitcoin, Ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Bloomingbit quotes the exchange as saying customer balances in those ten cryptocurrencies are fully backed. For most users, those ten names cover the coins they actually hold.
The remaining 10% sits in less liquid tokens. Per CoinDesk and Cointelegraph, Binance is buying them through public markets and over-the-counter trades, which takes longer because large orders in thin markets move prices against the buyer. CryptoTicker’s on-chain breakdown shows why that tail exists. The attacker took 63 additional tokens beyond the big names, including UNI, ENA, PEPE, LINK and AAVE.
A shortfall in small tokens is a manageable problem for a company that just found $6 billion, but it carries a market side effect. Every large buy order for an illiquid token pushes its price up, and the buyer is a well-known exchange. Traders watching those tokens should expect odd volume until Binance finishes.
How the Binance Hack Unfolded: The EIP-7702 Timeline
CryptoTicker reconstructed the on-chain sequence, and it shows an attack that ran in minutes. The hack hit Binance’s Ethereum hot wallet first, then spread across ten blockchains. CoinDesk dates the hack to Thursday, October 29. Cointelegraph’s article gives October 31, a conflict that CryptoTicker’s UTC timestamps resolve in favor of October 29.
Before the Sweep
On October 28, the attacker’s address received 0.1 ETH from Tornado Cash, according to CryptoTicker. That tiny transfer funded gas and hid the origin of the wallet. At 20:20:59 UTC on October 29, the attacker submitted an EIP-7702 delegation transaction that tied the Binance wallet to a contract the attacker controlled. EIP-7702 has been live on Ethereum since the Pectra upgrade in May 2025.
The Sweep Itself
| Time (UTC) | Event |
|---|---|
| Oct. 28 | Attacker address receives 0.1 ETH from Tornado Cash |
| Oct. 29, 20:20:59 | EIP-7702 delegation transaction ties the Binance wallet to the attacker’s contract |
| Oct. 29, 20:24:23 | Main sweep takes 167,464 ETH plus 63 tokens |
| Oct. 29, 20:39 | 195,460 ETH redirected to a secondary address |
| Oct. 29, 20:41 | 780 million USDC extracted |
| Oct. 29, 21:05 onward | Tether and Circle begin freezing stablecoins |
The sweep started about four minutes after the delegation. Freezes began less than an hour after it. That gap is the entire story of why roughly half of the haul is locked and the other half is not. Stablecoins have an issuer who can say stop. Native ETH and BTC do not. Our developer-focused look at the 20-minute heist covers the signing-infrastructure lessons in more depth.
The Entry Point: A DevOps Laptop and Multiple Factors
Binance’s early account, relayed by CryptoTicker, pointed to a compromised laptop belonging to a DevOps engineer. The laptop gave access to a service container that could submit unauthorized withdrawals. Binance said it saw no evidence that a wallet private key had leaked, which fits the EIP-7702 method since the attacker redirected control and did not need the key itself.
The story then widened. Binance’s service update, as quoted by CryptoTicker, said the incident stems from multiple factors and that the security team was tracing the full path through the compromised computer, which might be the entry point. CoinDesk’s coverage goes further and reports multiple breach points beyond the initially suspected laptop. We covered the early laptop claim in our report on the DevOps laptop and the $3 billion freeze.
Binance has promised a full post-mortem. Until it lands, the safest reading is that one endpoint was involved, other weaknesses were too, and the exchange has not yet published a final root cause. Anyone claiming a single clean explanation today is ahead of the evidence.
FBI Names North Korea’s TraderTraitor
The FBI confirmed that North Korea was responsible for the theft, according to CoinDesk, ABC News and Newsweek. The bureau pinned it on TraderTraitor, a North Korea-affiliated group. CoinDesk adds that TRM Labs and Chainalysis had already linked the attack to the same group before the FBI statement.
The FBI also said it expects the hackers to keep laundering funds through swap services and other decentralized finance tools, per the Yahoo and ABC coverage. CoinDesk reports that the bureau asked the DeFi community to block specific BTC, ETH and SOL addresses. The attackers have been converting the loot mainly into ether, according to the same reporting.
Attribution to a state-linked group changes the recovery math. A criminal crew might negotiate or make mistakes. A state program with a long laundering playbook usually does neither. Our earlier piece on the TRM Labs attribution lays out how the on-chain evidence first pointed that way.
How Much Was Frozen: Stablecoin Issuers and Partners
Frozen funds are where outlets disagree most. Binance and CoinDesk cite about $3 billion frozen by partners. CryptoTicker’s itemized figures add up to about $2.4 billion. Other coverage that includes Ripple and World Liberty Financial lands near $2.67 billion. We use the lowest figure, which Tether and Circle’s own numbers support, as the firm floor.
| Freezing party | Reported amount | Source |
|---|---|---|
| Tether | More than 1.567 billion USDT | CryptoTicker, search coverage |
| Circle | About 800 million USDC | CryptoTicker, search coverage |
| Tether, Circle, Ripple, World Liberty Financial combined | About $2.67 billion in stablecoins | Search coverage of the incident |
| Arbitrum Security Council | About $30 million in ETH and ARB | Search coverage of the incident |
| Total cited by Binance and CoinDesk | About $3 billion | CoinDesk, The Hacker News |
Frozen is not the same as returned. Those coins sit in wallets the issuers have blocked, and the path back to Binance depends on legal and technical steps nobody has confirmed. The 90% replacement does not rely on them, which is why Binance could move so fast. For the full freeze tally we reported earlier, see our breakdown of what stablecoin issuers froze.
The Attacker Still Holds Roughly $2.4 Billion
Search-index coverage of the incident says the attacker continues to control more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion. That pile is the real unknown. Binance can refill its books with its own money, but it cannot refill them with these coins unless they move to a freezable venue or get seized.
The FBI’s request that DeFi protocols block listed addresses targets exactly this problem. Native BTC cannot be frozen by a protocol, yet the exits for it, such as bridges, swap routers and exchanges, can refuse the deposits. We tracked how the BTC was split across 19 wallets with no freeze.
The FBI expects continued laundering through swap services and DeFi tools, and the attackers have already been converting mainly into ether. If they move in small pieces, the next 30 days are the window when most recoverable value is either caught or lost.
Proof, CertiK and the Verification Gap
Claims of full backing are only as good as the proof behind them. Cointelegraph reports that generating the full cryptographic proof takes about 40 to 50 hours because of the computation involved. CoinDesk puts the expected delivery at November 3, 2026.
Security firm CertiK, per Cointelegraph, asked for additional information to verify Binance’s claim about the $5 billion of replacement crypto. That request does not show the claim is false. It shows the claim is not yet independently confirmed, which is a normal state at this stage and an important one for readers to hold in mind.
The verification gap is a useful test of exchange transparency. If Binance publishes the proof on schedule and CertiK or another auditor signs off, the 90% figure becomes much harder to doubt. If the date slips, expect the withdrawal reopening to draw more suspicion than it should.
Binance Hack vs Bybit: Scale and Response
The previous record theft was the roughly $1.5 billion Bybit hack in early 2025, which the FBI also attributed to North Korea, as NBC News and TechRadar reported at the time. The Binance loss is about 4.2 times larger on the headline numbers. Cointelegraph calls it the largest hack in the crypto industry on record.
| Metric | Binance (Oct. 2026) | Bybit (early 2025) |
|---|---|---|
| Reported loss | About $6.3 billion | About $1.5 billion |
| Attribution | FBI: North Korea, TraderTraitor | FBI: North Korea |
| Who absorbs the loss | Binance, per its statements | Not covered in this fact sheet |
| Share replaced so far | 90%, up from 80% | Not covered in this fact sheet |
| Third-party freezes | About $2.4B to $3B | Not covered in this fact sheet |
The comparison is thin on purpose. We only table figures that outlets in our research confirmed for both cases, so several Bybit cells stay empty. The point holds without them. Binance’s loss is far bigger, and the speed of its stablecoin freezes and replacement buying is the main difference in outcome so far.
Market Impact: What This Means for Exchanges and Users
The coverage we reviewed gives no confirmed BNB price move tied to the 90% announcement, so we do not state one. What the reports do show is a market watching for two dates, the Sunday withdrawal restart and the November 3 proof. Both are binary tests of whether customers trust the company’s account of its own books.
What Users Should Do Now
Binance customers should expect balances in the ten backed assets to be intact and watch the proof publication before moving large sums. Anyone holding less liquid tokens on the exchange should read Binance’s updates for token-specific notes. Standard hygiene still applies, such as checking API key permissions and enabling withdrawal allowlists. For broader coverage of incidents like this one, see our cybersecurity section.
For other exchanges, the lesson is about concentration. A single hot wallet that can be redirected by one delegation transaction is a single point of failure. Teams that run signing infrastructure should audit what their service containers can authorize and who can reach them.
Historical Context: North Korea’s Crypto Theft Pattern
The Binance case fits a long run of state-linked crypto theft. Our reporting on North Korea’s 85% share of crypto hack value shows how a single actor now accounts for most stolen value. Bybit set the bar for size in 2025, and Binance has now raised it roughly fourfold.
The method stands out too. This attack used an Ethereum account feature that went live in May 2025, which suggests attackers can turn new protocol changes into tools within about 17 months. Defenders who treat each upgrade as a pure feature and not a new attack surface risk falling behind.
Five Predictions for the Next 30 Days
These are our analysis, not reported facts.
- Binance reaches full replacement of the remaining 10% within weeks, since the gap sits in illiquid tokens and the company has the cash to fill it.
- The cryptographic proof arrives close to the November 3 target. A slip of a few days would not mean failure, but a long delay would.
- Binance publishes its post-mortem and confirms more than one breach point, in line with its own wording about multiple factors.
- More DeFi protocols and bridges block flagged addresses after the FBI’s request, shrinking the attacker’s easy exits.
- Other major exchanges announce audits of hot-wallet delegation controls and service-container access, as security teams react to the EIP-7702 method.
Any of these could break if new facts surface. The biggest swing factor is how fast the attacker moves the remaining coins.
Frequently Asked Questions
Did Binance really cover 90% of the $6.3 billion hack losses?
Binance says it has replaced 90% of the stolen assets, per CoinDesk and Cointelegraph. Independent verification is pending, and CertiK has asked for more information.
Will Binance users lose money?
Binance says users will not bear the financial impact. Ten assets, including BTC, ETH, USDT and BNB, are reported as fully backed.
When do Binance withdrawals reopen?
Binance said it was on track to reopen withdrawals on Sunday, November 1, 2026. We could not confirm the reopening at the time of writing.
Who was behind the Binance hack?
The FBI said North Korea was responsible and named the TraderTraitor group, according to CoinDesk, ABC News and Newsweek.
How was the money stolen?
CryptoTicker’s timeline describes an EIP-7702 delegation that redirected control of a Binance wallet, followed by a sweep minutes later. Binance cited a compromised DevOps laptop and later said multiple factors were involved.
How much was frozen?
Figures range from about $2.4 billion to about $3 billion depending on the outlet. Tether froze more than 1.567 billion USDT and Circle about 800 million USDC.
What is still unresolved?
The final 10% of tokens, the full cryptographic proof, the published post-mortem, and the roughly $2.4 billion the attacker is reported to still hold.
