Binance says 90% of $6.3 billion hack losses are now covered, plans to resume withdrawals Sunday

“Covered” means Binance is replenishing the stolen token balances so users’ claims can be supported with equivalent assets. It does not mean the exchange has necessarily recovered the original tokens or identified the attacker. Binance says it will absorb the financial impact instead of passing it to customers.

The exchange reported coverage of up to 90% of the roughly $6.3 billion stolen from its hot wallets. It is using market purchases and over-the-counter channels to obtain missing tokens. Binance specifically said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are already 100% backed.

The remaining work concerns tokens outside Binance’s top 10. Those assets are less liquid and may take longer to source in the necessary quantities. Binance says its target remains 100% coverage for every relevant token, while it continues the investigation and prepares to resume withdrawals after security checks.

The breach involved roughly $6.3 billion in token assets stolen from Binance hot wallets. The article calls it the largest crypto theft on record. That figure shows why Binance’s response matters: the exchange must replace an enormous range of digital assets while maintaining customer access and confidence.

Binance said it had covered up to 90% of the stolen assets. Applying that percentage to $6.3 billion gives approximately $5.67 billion, although the article does not state that calculated dollar amount directly. The exchange said all BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC were fully backed.

About 10% remained uncovered when Binance made its statement. The shortfall consisted of less-liquid tokens outside its top 10. Binance said it would keep buying those assets through market and over-the-counter channels until coverage reached 100% for all relevant tokens.

If Binance resumes withdrawals, customers could regain the ability to transfer their assets from the exchange. That would be an important operational step after the theft, but the article does not promise that every withdrawal will immediately proceed without limits or review. Binance said resumption was its next milestone, subject to security checks.

The checks matter because attackers submitted unauthorized withdrawal transactions during the incident. Binance initially linked the breach to a compromised DevOps engineer’s laptop and access to a service container. Co-CEO Richard Teng later said the process was more complex than one engineer’s permissions being misused.

The exchange had not explained exactly how the attack happened and was continuing its investigation. Security checks can therefore help Binance examine systems before reopening withdrawals. The article gives no details about the checks’ design, duration, or customer-specific effects. It says Binance targeted Sunday for resumption, subject to those checks.

Liquidity describes how readily an asset can be bought in the needed amount. Binance said the uncovered 10% consists of tokens outside its top 10 and is less liquid. That makes replacement more difficult because the exchange may not find enough sellers quickly without moving the market.

Binance plans to source these tokens through market and over-the-counter channels. Market purchases use available trading venues, while over-the-counter deals arrange transactions more directly. The article does not give the names or quantities of the remaining tokens. It only explains that they may take longer to source in the required amounts.

This delay does not change Binance’s stated goal. The exchange said it would continue buying until coverage reaches 100% for all tokens. Meanwhile, it said the major named assets, including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC, were already fully backed. The unresolved portion is therefore concentrated in harder-to-source assets.

Binance says it will fund the replacement of stolen assets from several internal sources. These include its Secure Asset Fund for Users, a portion of its Futures insurance fund, and its corporate treasury. Together, those resources are intended to restore customer-backed assets after the theft.

The promise is about who bears the financial impact. Binance stated that it would absorb the loss from the stolen funds, not its users. It also said the named major tokens were fully backed, indicating that customers’ supported balances would not be reduced because of the incident.

Binance still had to source the remaining less-liquid tokens. It said it would keep buying them through market and over-the-counter channels until every relevant token reached 100% coverage. The article does not provide the dollar amounts taken from each funding source. It does report Binance’s broader commitment to transparent reporting, measurable progress, and concrete actions while the investigation continues.

An attacker can reach an exchange by compromising a device used by an employee with access to operational systems. Binance initially said a compromised DevOps engineer’s laptop may have allowed access to a service container. The attacker could then submit withdrawal transactions that the exchange had not authorized.

This example shows a chain of access rather than a simple customer password theft. The laptop provided a possible entry point, the service container provided access to a relevant system, and the unauthorized transactions moved assets out of hot wallets. The article does not establish that this was the complete method.

Co-CEO Richard Teng later said the attack involved a more complex process than misuse of one engineer’s permissions. Binance declined to provide additional investigative details, and the exact method remained unclear. TRM Labs said some features matched earlier North Korea-linked heists, but the article presents North Korean hackers only as potential culprits, not a confirmed attribution.

A hot wallet is a cryptocurrency wallet connected to the internet. Its connection makes it practical for an exchange to process transactions and withdrawals quickly. The source article does not define the term, but it states that the stolen token assets came from Binance’s hot wallets.

The same connection creates security risk. An attacker who gains access to the wallet, its keys, or systems authorized to operate it may be able to initiate transactions remotely. In Binance’s case, the exchange said an attacker may have reached a service container through a compromised DevOps engineer’s laptop and then submitted unauthorized withdrawal transactions.

Internet connectivity does not by itself prove how this breach occurred. Binance later said the attack was more complex than misuse of one engineer’s permissions, and the investigation continued. The incident illustrates why exchanges must secure both wallets and the surrounding systems that can authorize transfers. Binance planned security checks before resuming withdrawals.