.jpg?20261101')
CRYPTOCURRENCY exchange Binance said yesterday it has been able to cover 90 per cent of the amount stolen after a record $6.3 billion hack of its platform.
The outstanding 10pc consists of tokens that are less liquid, which means they may take longer to source in the required amounts, it said in a statement.
The exchange said it has set aside around $6.34bn of company funds internally to cover the losses.
Binance said the replenishment involved a partial deployment of its $1 billion Secure Asset Fund for Users (SAFU), a bitcoin reserve it holds to protect customers in the event of security breaches.
The company’s co-CEO, Richard Teng, said on Friday that the breach was a ‘complex attack’ involving a compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate.
Binance said it will continue to buy the remaining relevant token assets through market and over-the-counter channels until the covered amount reaches 100pc for all tokens.
“All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100pc,” Binance said in a statement. “Binance will absorb the financial impact of these stolen funds, not our users.”
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions,” Binance said.
The exchange said it remained on track to resume withdrawal services today, within its previously stated timeframe.
It wasn’t clear who was responsible for the breach. But TRM Labs, a blockchain intelligence and AI investigations company, pointed to North Korean hackers as the potential culprits.
“Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” the company said.
&uuid=(email))