Binance has replenished up to 90% of approximately $6.3 billion in cryptocurrency assets stolen from its hot wallets in what the exchange described as a record theft, as it works to restore withdrawal services and reassure customers that they will not bear the financial cost of the breach.
The world’s largest cryptocurrency exchange said on Saturday that it had fully backed its 10 largest affected tokens, including Bitcoin, Ether, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash. It plans to acquire the remaining stolen assets through market purchases and over-the-counter transactions until the shortfall is eliminated.
“All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%,” Binance said in a statement. “Binance will absorb the financial impact of these stolen funds, not our users.”
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
The remaining 10% consists of tokens outside the exchange’s top 10 holdings. Binance said these assets are less liquid and could take longer to source in the quantities required to restore the stolen balances.
The scale of the replenishment effort highlights the financial resources required to manage a security breach involving billions of dollars in digital assets. Rather than relying solely on available reserves, Binance said it is drawing on three sources: its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund and its corporate treasury.
The exchange has committed to covering the full financial impact of the incident, saying it will provide measurable progress and transparent reporting as it continues the recovery process.
Binance identified the resumption of customer withdrawals as its next major milestone, targeting Sunday, subject to security checks. The exchange said its investigation into the attack would continue alongside efforts to restore services.
The planned reopening is remarkable because customers’ ability to move assets off an exchange is a basic test of confidence following a major security incident. Even when an exchange promises to replace stolen funds, prolonged restrictions on withdrawals can raise concerns about liquidity, operational resilience and the safety of customer assets.
The circumstances surrounding the theft remain unclear. Binance initially said the breach may have involved a compromised laptop belonging to a DevOps engineer, which allegedly allowed an attacker to access a service container and submit unauthorized withdrawal transactions.
However, co-CEO Richard Teng later indicated that the attack involved a more complex process than the misuse of a single employee’s permissions.
The initial explanation pointed towards a possible weakness in an individual employee’s device or access privileges, while Teng’s subsequent comments suggested a broader sequence of security failures may have been involved. Binance has not publicly established the precise method used to execute the theft.
The investigation will need to determine how the attackers gained access, how withdrawal transactions were authorized, and whether other systems or credentials were compromised. Those details are important not only for identifying the perpetrators but also for assessing whether similar vulnerabilities could affect other exchanges.
Responsibility for the breach has also not been established. Blockchain intelligence and AI investigations company TRM Labs has pointed to North Korean hackers as potential perpetrators, citing similarities with previous attacks linked to the country.
TRM Labs said several features resembled earlier North Korea-linked cryptocurrency thefts, including the Bybit breach and the KelpDAO hack in April 2026.
“Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” the company said.
The similarities provide a possible investigative lead, but they do not establish North Korean responsibility for the Binance incident. Attribution in cryptocurrency thefts can be difficult because attackers can use mixers, intermediary wallets and other techniques to obscure the movement and origin of funds.
The reported use of Tornado Cash withdrawals and advance transaction preparation could help investigators trace the operational sequence, although further evidence would be required to confirm who carried out the attack.
Binance’s immediate priority is financial restitution and the restoration of normal services. Its decision to use insurance-related funds and corporate resources to replace the stolen assets is intended to separate customer balances from the losses caused by the breach.
However, replacing the tokens does not resolve the security questions raised by a theft of this scale. The exchange must still establish how the attackers penetrated its systems, whether its internal controls were adequate, and what changes are needed to prevent a recurrence.
The incident also places renewed attention on the risks associated with holding large quantities of cryptocurrency in hot wallets, which remain connected to systems that facilitate transactions. Their operational convenience makes them essential to exchange activity, but their exposure to online threats creates a persistent security challenge.