Reserve

Paid

insurance

SAFU

Billion

<h2 id="tldr">TLDR</h2>
<ul>
 <li>Binance says it has replaced all $6.34 billion in crypto stolen in the October 29 hack.</li>
 <li>The money came from its SAFU fund, futures insurance fund and corporate treasury.</li>
 <li>Binance plans to refill SAFU to roughly $1 billion.</li>
 <li>A new reserve snapshot covering 198 tokens shows 1:1 backing for user balances.</li>
 <li>Nearly $3 billion in stolen assets was frozen or intercepted after the attack.</li>
</ul>
Binance says it has used more than $6.34 billion of its own money to replace crypto stolen in an October 29 hack. <a href="https://www.binance.com/en-GB/support/announcement" rel="noopener noreferrer nofollow">The exchange announced on Thursday, November 12,</a> that the replacement process is complete.
The theft is the largest reported hack in crypto history. Binance, the world’s largest crypto exchange, said all user balances are now backed on a one-to-one basis.
The funds came from three places. Binance drew on its Secure Asset Fund for Users (SAFU), its futures insurance fund and its corporate treasury.
Over the past two weeks, the exchange bought replacement tokens on the open market. It also used over-the-counter trades, which are private deals made outside public order books.
Binance said it plans to refill SAFU to roughly $1 billion. The fund is meant to protect users in future emergencies.
“To our users and community: thank you for your patience and understanding,” the company posted on X. It also said it is continuing to strengthen its security systems.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 Binance has completed coverage of assets impacted in the security incident and we have published a new Proof of Reserves snapshot. Once the zero-knowledge proof is generated, users can independently verify that their assets are backed at a minimum of 1:1 -…
 — Binance (@binance) <a href="https://x.com/binance/status/2120921979226329504?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 12, 2026</a>
 </blockquote>
</div>
<h2 id="how-the-hack-happened">How the Hack Happened</h2>
Blockchain security firm TRM Labs reported that hackers drained Binance wallets across 10 blockchains. Most of the money was gone in about 20 minutes, and the firm tied the attack to TraderTraitor, a North Korean hacking group.
The same group has been linked to the $1.5 billion theft from crypto exchange Bybit in February 2025. The FBI has also blamed North Korea for the Binance attack.
Binance’s early investigation pointed to a compromised laptop belonging to a DevOps engineer. The company has since found other points of breach.
Nearly $3 billion in stolen assets was frozen or intercepted shortly after the hack. Binance is reportedly working with US authorities to recover those funds.
The hackers have moved the rest through thousands of wallets and transactions to hide where it came from, according to Bloomberg. They also created memecoins to launder about $430,000 in stolen assets.
<h2 id="what-the-reserve-snapshot-shows">What the Reserve Snapshot Shows</h2>
Binance released a new proof-of-reserves snapshot covering 198 tokens. Reserve ratios stayed above 100% for all major assets, including Bitcoin, Ether, Tether and BNB.
This report came outside the exchange’s usual monthly schedule. Binance released it because of the hack.
User Bitcoin holdings rose 0.35% from November 4 to about 687,900 BTC. That is an increase of 2,388 BTC.
Ether holdings climbed 1.04% to 3.48 million ETH. BNB holdings rose 1.03% to 42.95 million tokens.
Tether’s USDT showed the main decline. User holdings fell 3.68% to 24.3 billion tokens, a drop of about 928 million USDT.
The snapshot also lists many smaller tokens. These include Solana, USDC, Aave, Polkadot, Arbitrum, Hedera and Bitcoin Cash.
Users will be able to check their own balances once Binance generates the full proof. The exchange said that process should take 40 to 50 hours.
Binance said it will keep restoring withdrawals in phases while that work is completed.
The post <a href="https://blockonomi.com/how-binance-paid-back-6-3-billion-lost-in-north-korea-linked-hack/" rel="noopener noreferrer nofollow">How Binance Paid Back $6.3 Billion Lost in North Korea-Linked Hack</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

How Binance Paid Back $6.3 Billion Lost in North Korea-Linked Hack

Table of Contents

Blockonomi

Other articles published on Nov 13, 2026

Join our free newsletter for daily crypto updates!