Binance Says It Has Replaced All $6.3 Billion in Crypto Stolen in Record-Breaking Heist - Gizmodo

The exchange derived the money for the reimbursements from a mix of its Secure Asset Fund for Users (SAFU), futures insurance fund, and corporate treasury. Binance also said it plans to replenish SAFU to roughly $1 billion in preparation for future emergencies.

The exchange also published a new Proof of Reserves snapshot, which covers 198 tokens, to show that it has enough assets to back customer holdings on a one-to-one basis. Binance said users will be able to independently verify their holdings once it generates the full proof, a process the exchange said it expected to take 40 to 50 hours.

Hack Details

On October 29, Binance confirmed it had experienced a security incident involving approximately $6.3 billion in cryptocurrency. Blockchain security firm TRM Labs later reported that hackers stole the assets from Binance wallets across 10 blockchains, with most of the money vanishing in roughly 20 minutes.

Investigation Status

TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group also linked to the $1.5 billion theft from crypto exchange Bybit in February 2025. The FBI has since also blamed North Korea for the attack.

Binance said nearly $3 billion in stolen assets had been frozen or intercepted shortly after the hack. The company is reportedly working with the FBI to recover these funds. Meanwhile, the hackers have been moving portions of the remaining cryptocurrency through thousands of wallets and transactions to hide its origins.

Binance's initial investigation suggested that the attack may have started with a compromised laptop belonging to a DevOps engineer, although the company has since identified additional points of breach. In Thursday's announcement, Binance said it is continuing to strengthen its security infrastructure.