Secure

insurance

Richard

SAFU

<p>Binance has revealed that it has covered 90% of the roughly $6.3 billion stolen in Thursday’s hack, up from 80% in its previous update. The exchange says it plans <a href="https://x.com/binance/status/2116538196259684457?a=-X2lh58Mbi_plAgA0yg&amp;s=19" rel="noopener noreferrer nofollow">to reopen withdrawals</a> today, 1st November.</p>
<p>“We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%. Our users will not bear the financial impact of this incident,” co-CEO Richard Teng said on X on Saturday.</p>
<p>In its third and latest update, the company said the 10 largest tokens affected are “fully backed 100%”. These are BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% is in less liquid tokens outside that group, which may take longer to source.</p>
<div class="wp-block-image">
 <figure class="aligncenter size-full is-resized"><img width="720" height="1237" src="https://technext24.com/wp-content/uploads/2026/10/WA_1793471775148.jpeg" alt="Binance replaces 90% of stolen $6.3bn as withdrawals set to resume today" style="aspect-ratio:0.5820600769150815;width: 100%;height:auto">
 </figure>
</div>
<h3 id="where-is-the-money-coming-from" class="wp-block-heading">Where is the money coming from?</h3>
<p>Binance says it used three sources: a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its own corporate treasury. It later X post confirmed that the <a href="https://blockchair.com/bitcoin/transa…" rel="noopener noreferrer nofollow">SAFU transfer is complete</a>, pointing to a large transfer of 7,499 BTC visible on the blockchain.</p>
<p>SAFU is an emergency reserve set up in July 2018 for cases such as security breaches. It is held by Nest Clearing and Custody Limited, a clearing house regulated in Abu Dhabi. The crypto company says that it will replenish the fund to about $1 billion.</p>
<p>The Futures insurance fund protects traders from deficit losses on bankrupt positions and limits forced liquidations, known as auto-deleveraging.</p>
<p>Binance says it released only the amount above the fund’s required size and that the remaining balance is a regulatory requirement. It says the fund remains above the required coverage level, though no exchange can completely avoid auto-deleveraging.</p>
<p>Also read: <strong><a href="https://technext24.com/news/hackers-steal-6-3-bn-from-binance-crypto-heist/" rel="noopener noreferrer nofollow">North Korean-linked hackers steal $6.3 billion from Binance in biggest crypto heist ever</a></strong></p>
<h3 id="withdrawals-and-proof-of-reserves" class="wp-block-heading">Withdrawals and proof of reserves</h3>
<p>Binance suspended withdrawals after the attack, which it says began when its hot wallets were compromised at about 20:05 UTC on Thursday. It says deposits and other unaffected services have stayed operational.</p>
<p>The exchange says withdrawals will reopen in phases. It had earlier said it expected to resume within 48 hours.</p>
<p>The company has also published a new <a href="https://www.blockchain.com/explorer/addresses/btc/1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD" rel="noopener noreferrer nofollow">Proof of Reserves snapshot</a>, taken at midnight UTC on Saturday. The full zero-knowledge proof takes 40 to 50 hours to generate. It also says that holders of the 10 covered tokens will be able to verify at least 1:1 backing once it is done, which it estimates will be Tuesday. In an earlier update, it had said results would be ready by Monday.</p>
<div class="wp-block-image">
 <figure class="aligncenter size-full is-resized"><img width="720" height="1219" src="https://technext24.com/wp-content/uploads/2026/10/WA_1793472197367.jpeg" alt="Binance replaces 90% of stolen $6.3bn as withdrawals set to resume today" style="aspect-ratio:0.5906549941989242;width: 100%;height:auto">
 </figure>
</div>
<h3 id="what-binance-is-yet-to-address" class="wp-block-heading">What Binance is yet to address</h3>
<p>Binance’s first assessment pointed to a compromised engineer’s laptop. Its second update said further investigation “has uncovered additional points of breach.” Teng has described a “complex attack” involving a compromised laptop and malicious software designed to delete evidence. It says it has found no evidence that wallet private keys were leaked.</p>
<p>About $3 billion of the stolen assets has been frozen on-chain, according to Binance. That is separate from the 90% figure, which reflects replacing assets and not recovering them.</p>
<p><a href="https://technext24.com/crypto/binance-at-9-anniversary-achievements/" rel="noopener noreferrer nofollow">Binance’s updates</a> do not name those responsible. TRM Labs and Chainalysis have linked the attack to North Korea, <a href="https://technext24.com/news/hackers-steal-6-3-bn-from-binance-crypto-heist/" rel="noopener noreferrer nofollow">according to our earlier report</a>. The company says it expects to share further technical findings within about 48 hours of its second update and will publish a full post-mortem.</p>

Binance replaces 90% of stolen $6.3bn as withdrawals set to resume today

Table of Contents

Technext.ng

Other articles published on Nov 1, 2026

Join our free newsletter for daily crypto updates!