Binance says 90% of stolen assets now covered, withdrawals on track for Sunday

Binance said at 15:30 CET on Saturday, 31 October, that it has restored backing for 90% of the token assets taken from its hot wallets, two days after announcing a theft that CNBC put at roughly $6.3bn. CNBC and blockchain intelligence firm TRM Labs both describe it as the largest crypto theft on record. In its Update #3 posted on X, Binance said the ten tokens it listed, including bitcoin, ether and BNB, are now fully backed.

The 90% measures how much of the missing balance Binance has refilled with its own money. As CNBC noted, it does not mean 90% has come back from the attacker. Binance said it will keep buying the rest of the affected tokens on the market and through over-the-counter (OTC) deals until every token reaches 100%, and that the exchange, not its users, will bear the loss. It named three sources for the money so far:

Co-CEO Richard Teng wrote on X three minutes after the update: "We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%." He said Binance had also shared a new proof-of-reserves snapshot. Binance said holders of the ten fully backed tokens will be able to verify their own backing only once a full proof is generated.

The missing 10% sits in tokens outside the ten Binance listed. Binance said these trade less freely, so buying them in the quantities needed may take longer, and that it is working with industry partners to finish the purchases. It gave no date for reaching full coverage in its 31 October update.

Withdrawals were still suspended when Binance posted the update at 15:30 CET on 31 October, according to the exchange's statement. The exchange said it remains on track to reopen them within its earlier timeframe, on Sunday, 1 November, and will give a further update once details are confirmed. CNBC reported that the restart is subject to security checks and final confirmation, and that Binance declined to discuss its investigation further, pointing to its latest statement.

How the attacker got in remains unclear. Binance first said a compromised DevOps engineer's laptop may have been involved; Teng later said the attack was more complex than one engineer's permissions being misused, according to CNBC. CNBC reported that it was not clear who was responsible. TRM Labs attributes the theft to TraderTraitor, which it describes as North Korea's elite hacking unit, and says it holds that view with high confidence.