MORGANABLE BUSINESS / DIGITAL FINANCE
Binance has replaced about 90% of the cryptocurrency stolen in a major cyberattack that caused an estimated $6.3 billion loss, the exchange said on Saturday, October 31.
Akure —
Binance has replaced about 90% of the cryptocurrency stolen in a major cyberattack that caused an estimated $6.3 billion loss, the exchange said on Saturday, October 31.
The company said it used its own funds to buy replacement tokens and protect customers from the financial impact. It also promised to cover the remaining shortfall.
The update marks a significant step in Binance’s response to what could become the largest cryptocurrency theft on record.
However, replacing stolen assets does not mean investigators have recovered all the money or arrested those responsible.
The distinction matters as the exchange works to restore normal services and rebuild confidence.
Binance co-chief executive Richard Teng said the platform had replenished 90% of the affected assets. He added that customers would not bear the losses linked to the incident.
The remaining amount involves tokens that are less liquid and may take longer to source in the quantities required.
The company’s announcement followed a breach that affected digital assets worth about $6.3 billion. Binance said it had set aside approximately $6.34 billion in company resources to cover the impact.
It used part of its Secure Asset Fund for Users, known as SAFU, its Futures Insurance Fund and its corporate treasury to purchase replacement tokens.
The SAFU fund is a reserve Binance established to protect users during emergencies, including security incidents. The fund was valued at about $1 billion and held in bitcoin, according to earlier reporting.
Binance said it would replenish the reserve after using part of it for the response. This step is intended to preserve the fund’s role as a safety net for customers.
The exchange said the remaining 10% of affected assets would take longer to replace because some tokens have limited market liquidity.
In simple terms, fewer buyers and sellers trade these assets, so buying large quantities can be difficult. Large purchases may also move prices, increase costs or take time to complete. Binance said it would continue sourcing the outstanding tokens.
The incident triggered a wider security response across the cryptocurrency industry. Binance worked with blockchain companies, stablecoin issuers and law enforcement agencies to identify and freeze assets linked to the attack.
Earlier updates said partners had located about $3 billion in affected funds. Freezing assets can prevent criminals from moving them, although it does not automatically return them to their rightful owners.
The Federal Bureau of Investigation said on Saturday that North Korea’s state-sponsored hacking unit, known as TraderTraitor, was responsible for the attack.
The agency said members of the group had been observed converting stolen assets into ethereum. It also warned that further laundering could take place through related technology and services.
The attribution adds to concerns about North Korea-linked cyber operations targeting the digital asset industry. Authorities and blockchain research firms have previously linked the group to major cryptocurrency thefts.
Such operations can generate funds for illicit activities while exploiting weaknesses in exchanges, wallet systems and digital asset infrastructure. However, investigations must still establish the full path of the Binance breach.
Binance described the incident as a complex attack. Its initial investigation suggested that a compromised laptop belonging to an engineer may have provided an entry point.
The company also said attackers used malicious software designed to delete evidence of their activity. That could make it harder for investigators to establish exactly how the intruders gained access and moved the funds.
The exchange temporarily suspended customer withdrawals after detecting the breach. The move aimed to limit further unauthorised transfers while security teams investigated the incident and worked with partners.
Binance said it remained on track to resume withdrawals on Sunday, November 1. At the time of its Saturday update, the service had not yet fully reopened.
The suspension highlighted the tension exchanges face during major security incidents. Halting withdrawals can help contain suspicious activity, but it can also prevent customers from accessing their funds.
As a result, clear updates become essential. Binance has sought to reassure users that their balances remain protected and that the company will absorb the financial impact.
Proof of reserves is designed to show that a platform holds assets matching customer balances. However, it does not by itself provide a complete picture of a company’s liabilities, internal controls or cyber defences.
Independent checks and clear disclosures therefore remain important. Customers and market participants will likely watch for the full results and further details about the response.
The scale of the breach has renewed debate about how cryptocurrency exchanges protect assets held in internet-connected wallets.
These wallets allow platforms to process transactions quickly, but their connection to online systems can expose them to cyber threats.
Exchanges commonly use additional controls, including offline storage, access restrictions and approval processes. The incident has raised questions about whether existing safeguards were strong enough.
For Binance, replacing most of the affected assets is an important financial commitment, but it does not close the investigation.
The exchange still needs to account for the remaining tokens, complete its security review and demonstrate that it has addressed the weaknesses that allowed the attack.
It must also communicate clearly as withdrawals resume and customers assess the risks of keeping assets on centralised platforms.
The latest announcement offers customers some reassurance because Binance says it will absorb the losses rather than pass them on to users. Nevertheless, the episode shows that even large exchanges face serious cyber risks.
The final test will be whether Binance can fully replace the outstanding assets, restore services safely and provide credible evidence that its security systems are stronger.
The incident is likely to remain a warning for the wider digital asset sector. Further updates will determine how quickly confidence returns.
