coindesk.com
Binance says it has replenished 90% of the cryptocurrency stolen in Thursday’s $6.3 billion hack and remains on track to reopen withdrawals Sunday, Nov. 1.
The figure is up from about 80% in its previous update, and the exchange detailed that customer holdings of bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed.
The remaining 10% consists of less liquid tokens that Binance said may take longer to acquire in the required quantities. Binance said it is buying them through public markets and over-the-counter trades, working with industry partners to complete the purchases.
Binance had already set aside more than $6.34 billion in company funds, including $5 billion held in the affected cryptocurrencies. Those resources were separate from roughly $3 billion in stolen assets that partners had frozen.
“Binance will absorb the financial impact of these stolen funds, not our users,” the exchange’s update reads.
The replenishment addresses a shortfall in assets backing customer balances. A CoinDesk review of Binance’s earlier reserve disclosures found that wallets drained in the attack were among those the exchange listed as backing users’ holdings.
Binance said the replacement assets are being funded through its corporate treasury and a portion of its futures insurance fund, with a partial deployment of the Secure Asset Fund for Users, or SAFU, expected over the next 24 hours.
The fund normally covers losses from bankrupt trading positions and helps limit forced reductions in other traders’ positions, known as auto-deleveraging. Binance said it moved only the portion of the fund above its required size and that the remaining fund still meets its risk-management requirements.
The exchange also committed to restoring SAFU, its emergency user-protection reserve, to about $1 billion.
The security investigation remains open. Co-CEO Richard Teng said Friday that investigators had found additional breach points beyond an initially suspected compromised employee laptop, and U.S. President Donald Trump addressed the breach, saying “we don’t know” if North Korea was behind it, adding that the government is “looking at that.”
Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korea-linked hacking group.
Binance also published a new proof-of-reserves snapshot showing coverage ratios at 100% or more for the named tokens, taken at midnight UTC on Oct. 31.
The full cryptographic proof, which would let users independently verify that their balances are included in Binance’s reported liabilities, is expected by Nov. 3.
