Binance announced Saturday that it has restored backing for approximately 90% of the $6.3 billion in token assets stolen from its hot wallets in what has been described as a record crypto theft announced Thursday [1]. The exchange stated it has fully backed major assets at 100%, including BTC (Bitcoin), ETH (Ethereum), USDT (Tether), BNB (Binance Coin), SOL (Solana), USDC (USD Coin), XRP (Ripple), USD1, RLUSD, and ZEC (Zcash) [1]. Binance is utilizing multiple funding sources to replenish stolen assets, including the Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury, with the exchange committing that "Binance will absorb the financial impact of these stolen funds, not our users" [1].
The outstanding 10% of coverage consists of tokens outside Binance's top 10 that are "less liquid, which means they may take longer to source in the required amounts," though the exchange said it will continue to purchase remaining token assets through market and over-the-counter channels until reaching 100% coverage for all tokens [1]. Binance remains on track to reopen withdrawals by Sunday, subject to security checks and final confirmation [1]. Regarding the attack itself, Binance initially suggested the hack may have involved "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," but Co-CEO Richard Teng later clarified that the attack involved a more complex process rather than misuse of a single engineer's permissions [1].
The investigation into the breach remains ongoing, with unclear details about how the attack took place and who was responsible [1]. TRM Labs, a blockchain intelligence and AI investigations company, pointed to North Korean hackers as potential culprits, noting that "several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst" [1]. Binance did not immediately respond to CNBC for additional details or updates on its investigation [1].
CONCLUSION
Binance's rapid coverage of 90% of the $6.3 billion theft and commitment to absorb all losses mitigates immediate user confidence concerns, with full withdrawal resumption planned for Sunday [1]. However, the remaining 10% coverage gap and ongoing investigation into the sophisticated attack—potentially linked to North Korean hackers—highlight persistent security vulnerabilities in the crypto exchange ecosystem [1]. The incident represents the largest crypto theft on record and underscores systemic risks in centralized exchange operations [1].