Binance has covered 90% of stolen user assets in $6.3 billion hack

Binance stated Saturday that it has coated as much as 90% of the roughly $6.3 billion in token assets stolen from its hot wallets in a file crypto theft introduced Thursday.

Binance stated it is going to proceed to purchase the remaining related token belongings via market and over-the-counter channels till the coated quantity reaches 100% for all tokens.

“All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are absolutely backed 100%,” Binance stated in a statement. “Binance will take up the monetary influence of those stolen funds, not our customers.”

The alternate stated the excellent 10% consists of tokens outdoors its high 10 which can be “much less liquid, which implies they could take longer to supply within the required quantities.”

Binance stated it’s tapping its Safe Asset Fund for Customers (SAFU), a portion of its Futures insurance coverage fund, and its company treasury to replenish the belongings.

“Our dedication stays the identical: Binance will absolutely cowl the monetary influence of the funds stolen on this incident. We are going to proceed to show this dedication via measurable progress, clear reporting, and concrete actions,” Binance stated.

Its “subsequent milestone” shall be resuming withdrawal providers for customers by Sunday, topic to safety checks, whereas the alternate continues its investigation into the assault, it stated.

Binance didn’t instantly reply to CNBC for extra particulars or updates on its investigation.

It nonetheless is not clear how the assault — the largest crypto theft on record — befell.

The world’s largest crypto alternate initially stated the hack could contain “a compromised DevOps engineer’s laptop computer, which allowed an attacker to realize entry to a service container and submit unauthorized withdrawal transactions.” Nevertheless, Co-CEO Richard Teng later stated the assault concerned a extra advanced course of relatively than the misuse of a single engineer’s permissions.

It additionally wasn’t clear who was accountable for the breach. However TRM Labs, a blockchain intelligence and AI investigations firm, pointed to North Korean hackers as the potential culprits.

“A number of options of this assault match earlier North Korea-linked heists, together with the Bybit hack and the KelpDAO hack in April 2026: small Twister Money withdrawals funding an operator pockets, staging that started effectively earlier than the theft, and signatures obtained upfront then executed in a single burst,” the corporate stated.

— CNBC’s Jenny Lee, Liz Napolitano and Davis Giangiulio contributed to this report.