Binance says it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets. The exchange plans to reopen withdrawals Sunday, subject to security checks. How the attack happened is still unclear.
Binance said Saturday that it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets in a record crypto theft announced Thursday. CNBC notes the figure reflects restored backing, not 90% recovered from the attacker.
Binance names the funds it is tapping
Binance said it is tapping its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish the assets. It will keep buying the remaining relevant token assets through market and over-the-counter channels until coverage reaches 100% for all tokens.
The outstanding 10% consists of tokens outside its top 10 that are less liquid, which Binance says may take longer to source. Meanwhile, BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%, according to the exchange.
According to Binance: "Binance will absorb the financial impact of these stolen funds, not our users." The statement also calls resuming withdrawals by Sunday its next milestone.
Cause and culprit remain unclear
It still isn't clear how the attack took place. Binance initially said the hack may involve a compromised DevOps engineer's laptop, but Co-CEO Richard Teng later said the attack involved a more complex process rather than the misuse of a single engineer's permissions.
It also wasn't clear who was responsible. However, TRM Labs pointed to North Korean hackers as the potential culprits, citing features that match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026.
Binance declined to give CNBC additional details on its investigation.
Source: CNBC
Trading involves risk.
Risk Disclaimer
