Binance Covers 90% of $6.3B Crypto Hack Losses, Plans Withdrawal Resumption

Binance, the world's largest cryptocurrency exchange, announced on Saturday that it has successfully recovered approximately 90% of the nearly $6.3 billion in digital assets stolen from its hot wallets in what stands as the largest crypto theft ever recorded.

The exchange revealed that it is actively purchasing the remaining tokens through both market operations and over-the-counter transactions to restore the full value of all affected assets. Binance confirmed that certain tokens, particularly those outside its top 10 most liquid ones, are more challenging to source in large quantities. These less liquid tokens make up the outstanding 10% yet to be covered.

In its official statement, Binance emphasized, "All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%. Binance will absorb the financial impact of these stolen funds, not our users." This assurance aims to protect customer funds entirely despite the scale of the breach.

To replenish the stolen assets, Binance is utilizing multiple internal resources, including its Secure Asset Fund for Users (SAFU), a segment of its Futures insurance reserves, and its corporate treasury. The company reaffirmed its commitment to fully cover the loss, promising ongoing transparency and progress updates.

Binance also announced plans to restart withdrawal services for its users by Sunday, pending completion of necessary security evaluations. The exchange is continuing its investigation into the incident but has not provided further details, referring inquiries to its latest public statement.

The exact method behind the breach remains unclear. Initially, Binance suggested that the attack might have involved a compromised DevOps engineer's laptop, which allegedly allowed unauthorized withdrawal requests through access to a service container. However, Co-CEO Richard Teng later described the hack as a more intricate operation than a single individual’s credentials being exploited.

No confirmed information has been released regarding the perpetrators. Nonetheless, TRM Labs, a blockchain intelligence and artificial intelligence investigation firm, has pointed to North Korean hackers as likely responsible. According to TRM Labs, the attack shares characteristics with previous North Korea-linked cybercrimes, such as the Bybit and KelpDAO hacks in April 2026. These include small withdrawals through the Tornado Cash mixer funneling funds to an operator wallet, premeditated staging before the theft, and pre-obtained signatures executed all at once.

This incident highlights ongoing security concerns within the cryptocurrency sector, where exchanges managing vast sums of digital assets remain targets for increasingly sophisticated cyberattacks. Binance’s approach to compensating users and resuming operations swiftly reflects a broader industry trend toward enhancing transparency and crisis management following such events.

As investigations continue, Binance’s efforts to recover all stolen tokens and protect users' assets will be closely watched by market participants and regulators. The incident serves as a reminder of the importance of robust security protocols in the rapidly expanding digital asset space.