Binance says it has replaced 90% of the assets stolen in the $6.3 billion hack, but customers still can't withdraw their money. The exchange is buying the remaining tokens while it works toward reopening withdrawals on Sunday.
The attack has been linked to North Korea by private blockchain investigators, as Apex previously reported. That attribution is an intelligence assessment, rather than a publicly announced finding by U.S. authorities.
In its third incident update on Saturday, the company said replacement purchases had moved beyond the roughly 80% covered at its previous update. It has set aside more than $6.34 billion of company funds to cover the losses.
That money is being used to replace what was taken. It is separate from efforts to track down and recover the original stolen crypto.
The last 10% is harder to buy
Binance says ten assets now have full reserve backing: Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash. Co-founder Yi He repeated that list in a separate statement on X.
The remaining purchases involve other tokens. The company explained:
The outstanding 10% consists of tokens outside the top ten listed above. These assets are less liquid, which means they may take longer to source in the required amounts.
Binance is buying through the market and over-the-counter deals, which arrange purchases directly rather than placing everything on an exchange's public order book. It says it is working with industry partners to find enough of those assets.
The 90% figure is Binance's own account of its progress. Its latest announcement does not give a token-by-token breakdown of the outstanding purchases or a separate completion date for each one.
Binance is drawing on more than its treasury
The replacement effort combines company treasury funds, part of the Secure Asset Fund for Users, known as SAFU, and a portion of Binance's futures insurance funds.
SAFU was established in July 2018 as an emergency reserve for events such as security breaches. Binance says part of its deployment will take place over the next 24 hours, and it has committed to restoring the fund to approximately $1 billion afterward.
The futures insurance funds normally help cover losses when traders' positions are liquidated without enough money left to settle them. Binance says those reserves belong to the company and are not customer assets.
Using some of that money raises a question for futures traders: how much protection remains if markets move sharply? Binance says it has kept the funds above the level required by its risk-management framework and transferred only the excess.
The company says it tests those balances against severe historical market conditions and adds corporate funds when needed. It also acknowledges that no exchange can eliminate the risk of automatic deleveraging, which can reduce profitable traders' positions during a shortfall.
Withdrawals and reserve checks have different deadlines
Co-CEO Richard Teng's Saturday statement kept the withdrawal restart on the same schedule:
We've also shared an updated Proof of Reserves snapshot, and we're working towards resuming withdrawals on November 1.
That remains a target for restoring access, rather than an announcement that the service has reopened.
The exchange also says it has updated its Proof of Reserves page with a new snapshot dated October 31. The full cryptographic proof is expected by Tuesday, November 3, according to the latest company update.
Binance says generating that proof takes about 40-50 hours of computing work. Once it is ready, holders of the ten listed tokens should be able to check that their balances are included and backed at least one-for-one.
The verification process checks whether a customer's balance appears in the total that Binance reports. The exchange says its futures insurance funds sit outside that customer Proof of Reserves system; their balances can be viewed separately on its insurance-fund page.