Binance, the world's largest cryptocurrency exchange, said on Saturday, October 31, 2026, that it has covered 90 percent of the estimated $6.3 billion stolen in the largest cryptocurrency theft on record, and that withdrawal services for users are expected to resume on November 1. The update marks the clearest sign yet that the exchange is moving from emergency containment to recovery, two days after hackers drained its hot wallets in an attack that shook crypto markets around the world.
In a status update posted to its website, Binance said the money to cover the stolen funds would come from three sources: a partial deployment of its Secure Asset Fund for Users, known as SAFU, a portion of its Futures insurance fund, and the company's own corporate treasury. Users were also invited to check the balances of the first two funds online. The remaining 10 percent of the stolen amount consists of less liquid tokens, the company said, which may take longer to source in the required amounts.
The hack began in the early hours of Friday, October 30, 2026. Funds began leaving Binance's hot wallets — the internet-connected wallets used to process customer withdrawals — at about 12:24 a.m. UAE time, according to The National's account of the incident. A single transaction moved roughly 167,464 Ether, worth about $388 million, along with 63 other tokens, to an address created hours earlier and funded through the Tornado Cash mixing service, according to Etherscan data cited in that report.
Binance suspended deposits and withdrawals while it investigated, and said in an update on X that the estimated total impact sat at around $6.3 billion. "We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far," the exchange said. Co-founder Yi He said in a post on X that withdrawals were expected to resume within 48 hours once a security revamp of the withdrawal service was complete.
The Saturday update goes further than the first emergency statements. Rather than simply promising that user funds are safe, Binance has now put a number on how much of the loss it has already covered — 90 percent — and named the three pots of money it is drawing on. The company also said the outstanding 10 percent is made up of tokens that are less liquid, meaning they cannot simply be bought back instantly in the required amounts, so that slice of the recovery may take longer.
Bitcoin fell sharply after news of the hack broke and has since traded at about $76,450, according to CoinMarketCap data cited by The National, a reminder that even a promise of full coverage does not immediately calm a market rattled by a theft of this size.
The Binance hack is roughly four times larger than the previous record crypto theft, the roughly $1.5 billion taken from the Bybit exchange in February 2025. That earlier heist was attributed by the FBI to TraderTraitor, the same North Korea-linked operation that blockchain intelligence firm TRM Labs now blames for the Binance attack.
TRM Labs said it attributes the attack to TraderTraitor "based on robust on and off-chain intelligence" and called it "the largest crypto theft on record." The firm has been careful to distinguish its own assessment from an official government finding: as of its October 30 assessment, no government had formally attributed this theft. Blockchain analytics firm Arkham Intelligence reported that 70 wallet addresses believed to belong to the attackers held a combined $5.788 billion in cryptocurrency as of 2:25 p.m. on October 30, including 1.768 billion Tether (USDT), 18,270 Bitcoin, 497,976 Ether and about 824.6 million USD Coin (USDC).
Binance's own investigation has evolved as it has dug deeper. Its initial finding pointed to a compromised laptop belonging to a DevOps engineer, which the company said allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. Binance said it found no evidence that wallet private keys had leaked. A later update said investigators had uncovered additional points of breach, and the company described the incident as a "complex attack" being handled in coordination with law enforcement.
This is not the first time Binance has leaned on SAFU, the emergency insurance fund it created to protect users in extreme cases. In an earlier update reported on October 31, Binance said it had set aside more than $6.34 billion to cover the theft, including $5 billion already held in the affected token assets — roughly 80 percent of the total at that point. The Saturday statement that 90 percent is now covered suggests that work has continued through the weekend, with the Futures insurance fund and the corporate treasury closing more of the gap.
US News Pulse has followed the story since the first hours of the attack. Our earlier coverage reported the initial hack and the suspension of withdrawals, and then the TRM Labs attribution to a North Korea-linked unit. This article is the next chapter: the recovery, not a repeat of the hack itself.
The three funding sources Binance named each play a different role. SAFU, the Secure Asset Fund for Users, is the exchange's dedicated emergency reserve, built up over years precisely for events like this. The Futures insurance fund normally backstops losses in leveraged futures trading, and drawing on a portion of it shows how far Binance is willing to go to make users whole. The corporate treasury covers the rest, meaning the company's own balance sheet — not customer deposits — absorbs the blow.
That distinction matters to users. Binance has repeatedly said it will cover all losses from SAFU and company funds, and that user funds are safe. Co-founder Changpeng Zhao, who no longer runs the company but remains its largest shareholder, wrote on X: "User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m)." Those freezes by the two stablecoin issuers are part of the roughly $3 billion frozen on-chain so far, and they illustrate why the recovery has moved faster than many expected: once stolen tokens are frozen at the issuer level, they cannot be cashed out, even if they have not yet been returned.
What remains uncertain is the final 10 percent. Less liquid tokens cannot be replaced at scale without moving their prices, and some may be sitting in wallets that have not yet been frozen. Binance has not given a date for covering that remainder, only that it may take longer to source the required amounts. Users should therefore read the 90 percent figure as substantial progress, not as the end of the story.
Binance's own statements have set the tone throughout the incident. In its first update, the exchange said: "The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far." It added: "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete."
On the investigation, Binance said its initial findings suggested "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions," and that it had "found no evidence of any wallet private key leak." The company promised "a detailed technical post-mortem once the investigation is complete and the facts are fully verified."
TRM Labs, the blockchain intelligence firm behind the attribution, said: "TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence." The firm also noted that crypto hacks have now caused cumulative losses of about $28 billion, including the Binance theft, a figure that puts the scale of the problem in stark perspective.
Market reaction has been severe. Bitcoin dropped sharply when the hack was disclosed, and the wider crypto market fell with it, as traders weighed both the direct losses and the possibility of further selling if the attackers managed to move frozen funds. The recovery update, and the prospect of withdrawals resuming on November 1, may ease some of that pressure, but analysts quoted in coverage of the hack have warned that confidence will take longer to rebuild than balances.
The Binance hack matters far beyond one exchange because Binance is the world's largest crypto exchange by daily trading volume. When it suspends withdrawals, millions of users in dozens of countries feel it immediately, and when $6.3 billion moves in a single attack, it tests every assumption the industry makes about hot-wallet security, insider access and emergency reserves.
The recovery also matters as a test of the SAFU model. Emergency funds are easy to promise and hard to use well: they must be large enough, liquid enough and transparent enough to convince users that their money is genuinely covered. By naming its three funding sources and inviting users to check the SAFU and Futures insurance fund balances online, Binance is making its recovery verifiable in a way that a simple reassurance never could be. If the remaining 10 percent is covered in the coming days, the episode could become a case study in how a large exchange survives a record theft. If it drags on, it will instead fuel arguments for tougher regulation, stricter custody rules and smaller hot wallets across the industry.
There is also a geopolitical dimension. If the TRM Labs attribution holds, this would be the largest known North Korean crypto theft by a wide margin, dwarfing the Bybit heist, and it would show that state-linked hacking groups can still penetrate the defences of the biggest platforms in the market. That has implications for sanctions enforcement, for US law enforcement involvement in the recovery effort, and for how exchanges vet the laptops, containers and internal tools that attackers exploited here.
The immediate milestone is November 1, when Binance says withdrawal services are expected to resume, with further details to be confirmed. Users should watch for the exchange's own status update rather than social media rumours, and should expect a phased return: security revamps of this kind are often rolled out gradually, with limits or delays on some assets while checks continue.
Next, Binance has promised an updated Proof of Reserves once remediation is complete, and a detailed technical post-mortem once the facts are fully verified. Both documents will be closely read: the first for evidence that customer assets are fully backed, the second for an explanation of how an attacker moved from a single compromised laptop to a multi-billion-dollar withdrawal spree, and what has changed to stop it happening again.
Law enforcement and blockchain partners will continue tracing and freezing the stolen funds in parallel. About $3 billion has already been frozen on-chain, and every additional freeze shrinks the amount Binance must cover from its own funds — and the amount the attackers can ever realise. The less liquid 10 percent will be the hardest part of that chase, and its fate may not be known for weeks.
For the wider market, the question is whether Bitcoin and other major tokens stabilise once withdrawals resume, or whether the hack leaves a lasting discount on exchange-held assets. Either way, the Binance recovery will be watched as a benchmark: the biggest hack in crypto history, and now the biggest test of whether an exchange can pay its way out of one.
Binance says it has covered 90 percent of the $6.3 billion stolen, using a partial SAFU deployment, part of its Futures insurance fund and its corporate treasury. The remaining 10 percent is in less liquid tokens and may take longer to source.
Binance says withdrawal services are expected to resume on November 1, 2026, with further details to be confirmed. The exchange earlier said withdrawals would return within 48 hours of the October 30 suspension, once a security revamp was complete.
Binance says user funds are safe and that it will cover all losses from SAFU and company funds. It has also promised an updated Proof of Reserves once remediation is complete.
TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korea-linked hacking unit. No government had formally attributed this specific theft as of TRM Labs' October 30 assessment.
At about $6.3 billion, it is the largest crypto theft on record — roughly four times the $1.5 billion stolen from Bybit in February 2025, the previous record.
Related coverage: Binance Hack Drains $5.7 Billion in Largest Crypto Heist Ever Reported, Binance Suspends Withdrawals for All Users, Confirms $6.3 Billion Hack Impact, Binance North Korea Hack Blamed for $6 Billion Heist as FBI Joins Recovery.
Leave a Comment
| Today's Date:
