Key Takeaways
- • Binance said it has finished replacing all cryptocurrency stolen in the October 29 security incident, committing more than $6.34 billion in company funds to cover losses from roughly $6.3 billion in stolen assets.
- • Reimbursements were funded from the Secure Asset Fund for Users (SAFU), the futures insurance fund, and corporate treasury, with replacement tokens bought through open markets and over-the-counter transactions over the past two weeks.
- • Binance plans to replenish SAFU to roughly $1 billion ahead of future emergencies and published a new Proof of Reserves snapshot covering 198 tokens.
- • TRM Labs attributed the hack to North Korea-linked group TraderTraitor, and the FBI has also blamed North Korea; nearly $3 billion in stolen assets was reportedly frozen or intercepted.
Summary
Binance announced on Thursday that it has finished replacing all cryptocurrency stolen in the October 29 attack, which it described as the largest reported crypto theft in history. The world's largest crypto exchange said it committed more than $6.34 billion in company funds to cover the losses. Over the past two weeks, Binance bought replacement tokens through regular markets and over-the-counter transactions.
According to the exchange, the reimbursements were drawn from a mix of its Secure Asset Fund for Users (SAFU), its futures insurance fund, and corporate treasury. Binance also said it plans to replenish SAFU to roughly $1 billion in preparation for future emergencies. The exchange published a new Proof of Reserves snapshot covering 198 tokens to show it holds enough assets to back customer holdings one-to-one. Users will be able to independently verify their holdings once the full proof is generated, a process Binance expects to take 40 to 50 hours. Withdrawals will continue to be restored in phases.
Binance confirmed the security incident on October 29, involving approximately $6.3 billion in cryptocurrency. Blockchain security firm TRM Labs reported that the assets were taken from Binance wallets across 10 blockchains, with most of the funds vanishing in roughly 20 minutes. TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group also linked to the $1.5 billion theft from Bybit in February 2025, and the FBI has since also blamed North Korea. Binance said nearly $3 billion in stolen assets was frozen or intercepted shortly after the hack and is reportedly working with the FBI to recover these funds.
Bloomberg reports that the hackers have moved portions of the remaining cryptocurrency through thousands of wallets and transactions to obscure its origins, and created memecoins to launder about $430,000 in stolen assets. Binance's initial investigation suggested the attack may have started with a compromised laptop belonging to a DevOps engineer, although the company has since identified additional points of breach. Binance said it is continuing to strengthen its security infrastructure. The exchange did not immediately respond to a request for comment.
According to the exchange, the reimbursements were drawn from a mix of its Secure Asset Fund for Users (SAFU), its futures insurance fund, and corporate treasury. Binance also said it plans to replenish SAFU to roughly $1 billion in preparation for future emergencies. The exchange published a new Proof of Reserves snapshot covering 198 tokens to show it holds enough assets to back customer holdings one-to-one. Users will be able to independently verify their holdings once the full proof is generated, a process Binance expects to take 40 to 50 hours. Withdrawals will continue to be restored in phases.
Binance confirmed the security incident on October 29, involving approximately $6.3 billion in cryptocurrency. Blockchain security firm TRM Labs reported that the assets were taken from Binance wallets across 10 blockchains, with most of the funds vanishing in roughly 20 minutes. TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group also linked to the $1.5 billion theft from Bybit in February 2025, and the FBI has since also blamed North Korea. Binance said nearly $3 billion in stolen assets was frozen or intercepted shortly after the hack and is reportedly working with the FBI to recover these funds.
Bloomberg reports that the hackers have moved portions of the remaining cryptocurrency through thousands of wallets and transactions to obscure its origins, and created memecoins to launder about $430,000 in stolen assets. Binance's initial investigation suggested the attack may have started with a compromised laptop belonging to a DevOps engineer, although the company has since identified additional points of breach. Binance said it is continuing to strengthen its security infrastructure. The exchange did not immediately respond to a request for comment.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.