Binance Has Rebuilt 90% of a $6.3 Billion Hole. The Last 10% Is the Hard Part

On October 29, an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, most of it inside about 20 minutes starting at 20:05 UTC. Binance confirmed a security incident, suspended withdrawals on several networks, and put the financial impact at about $6.3 billion. By October 31, the exchange said it had replaced 90% of the stolen crypto, up from roughly 80% a day earlier, and planned to reopen withdrawals on Sunday, November 1.

The replenishment is the story. Binance is not simply absorbing a loss; it is rebuilding customer balances in public from a defined stack of its own money. Funding comes from corporate reserves, the futures insurance fund, and part of SAFU, the exchange's emergency fund, which Binance says it will rebuild to about $1 billion. Ten major cryptocurrencies — bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC — are fully backed. The remaining 10% sits in thinner-traded tokens that Binance is buying on public markets and through over-the-counter trades, a slower and more expensive process than topping up liquid assets.

Separately, Binance says about $3 billion of the stolen assets has been frozen through cooperation with law enforcement and blockchain intelligence companies. That money is not yet returned to customers, and it is not clear how much of it will be.

Attribution points to North Korea. TRM Labs and Chainalysis both attribute the hack to TraderTraitor, a label used for North Korea-linked activity. The initial investigation suggests the attacker may have gained access through a compromised laptop belonging to a DevOps engineer, which would put the entry point in the operational tooling around the exchange rather than in a smart contract or customer-facing service. A full zero-knowledge proof of the replenishment is due by November 3.

The scale matters. At roughly $6.3 billion, this is about four times the $1.5 billion Bybit hack of February 2025 and the largest crypto theft on record. The test is whether the world's largest exchange by trading volume can absorb a loss that size without passing it to customers. So far, the answer is that it is trying to — using reserves and insurance capacity that now have to be rebuilt.