Binance Says It Has Replaced 90% of Stolen Funds as FBI Joins $6.3 Billion Hack Probe

Binance says it has now replaced 90% of the crypto stolen in this week's record hack, and that it is still working towards switching withdrawals back on on Sunday, 1 November. The update came on Saturday, two days after attackers drained an estimated $6.3 billion from the exchange's hot wallets.

The remaining 10% is made up of less liquid tokens that may take longer to buy in the amounts needed, Binance said in a statement reported by Reuters. At the same time, U.S. law enforcement has stepped into the case, with the FBI and the Secret Service both now involved.

What Binance announced on Saturday

Co-CEO Richard Teng put the message plainly in a post shared on Saturday. "We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident," he wrote.

That is up from roughly 80% in the exchange's previous update, according to Crypto Briefing and TokenPost. Binance said ten assets are now fully backed at 100%: BTC, ETH, BNB, SOL, XRP, USDT, USDC, USD1, RLUSD and ZEC.

Everything outside that list sits in the missing 10%. Binance has said it is buying the remaining affected assets through market and over-the-counter channels, and on Friday it said it had set aside more than $6.34 billion in company funds to cover the losses, Investing.com reported.

Where the money is coming from

Binance is drawing on three pots, according to Reuters via Business Standard and Crypto Briefing: its Secure Asset Fund for Users (SAFU), part of its Futures insurance fund, and its own corporate treasury.

SAFU, set up in 2018 as an emergency reserve for events like this one, will be partly deployed within the next 24 hours. Binance has committed to topping the fund back up to around $1 billion afterwards, Crypto Briefing reported.

The exchange said the Futures insurance fund, which absorbs losses from bankrupt futures positions and helps limit auto-deleveraging, remains above the minimum its risk rules require. If it slips below that line, Binance says corporate money will fill the gap.

None of this touches the roughly $3 billion that industry partners froze on-chain in the first hours after the theft. Those freezes, by Tether, Circle, Ripple and others, are covered in our report on the $6.3 billion Binance hack.

Withdrawals and a new proof of reserves

Withdrawals have been paused since Thursday. Binance says restoring them is now its top priority, with service expected to reopen on 1 November after security checks and in phases, according to Investing.com and TokenPost.

To back up its claims, the exchange took a fresh proof-of-reserves snapshot at 00:00 UTC on Saturday, 31 October. Generating the full zero-knowledge proof needs about 40 to 50 hours of computing, so the complete results are expected by 3 November (UTC), Crypto Briefing and TokenPost reported.

Once that proof is out, users holding any of the ten fully backed tokens should be able to check that their balances carry at least 1:1 backing. Whether those snapshots really prove solvency is an old argument in crypto, and one that Michael Saylor has weighed in on before.

The FBI and Secret Service join the hunt

The FBI said it was coordinating with partners to assess the scope of the incident and decide on investigative steps, in a statement to Bloomberg News on Friday cited by Investing.com. The Secret Service is working with the private sector to recover stolen funds, while the Justice Department said it was aware of the reports but declined to comment.

Blockchain analytics firms TRM Labs, Chainalysis and Elliptic have all pointed to North Korea. Investigators linked the activity to the TraderTraitor group, and Chainalysis said it had spotted laundering patterns it had not seen before, spread over thousands of transactions.

The attackers also converted $325 million in stablecoins into $285 million in ether, Investing.com reported, apparently to move the money out of reach of issuer freezes. That matters because tokens such as USDT and USDC can be frozen by their issuers, while bitcoin and ether cannot.

How the market is taking it

Bitcoin was trading around $77,400 on Saturday afternoon, down 0.3% on the day, according to Investing.com. It had dropped below $77,000 for the first time in more than a month on Friday as the hack news spread.

The bigger signal came from funds. U.S. spot bitcoin ETFs saw $643.33 million in net outflows on Friday, SoSoValue data showed, ending a four-day run of inflows that had brought in about $440.73 million between 26 and 29 October.

BNB, the token most tied to the exchange's fortunes, was up 1.1% at $707.50 on Saturday, while ether gained 0.9% to about $2,248 and XRP slipped 0.5% to $1.2489, Investing.com reported.

Is it safe to leave crypto on an exchange?

The hack has reopened a familiar debate. "I think you should be very wary of leaving any significant amount of funds in an exchange… there are no built-in protections for when these inevitable hacks take place," University of Tulsa cybersecurity professor Tyler Moore told CNBC.

Others drew the opposite lesson. Blockaid CEO Ido Ben-Natan told CNBC: "I actually think no users will lose any money. Binance has said they're going to cover everything." University of Pennsylvania professor Brett Falk argued that a company-backed exchange may be a safer place than a self-custody wallet, where nobody can refund a loss.

CNBC also noted the breach hit Binance's offshore platform, not U.S.-regulated venues. CFTC Chairman Michael Selig said offshore exchanges "don't have the same sorts of safeguards that we have in our financial markets." For readers rethinking where they keep coins, our guide to how hardware wallets and self-custody work covers the other side of the trade-off.

What happens next

Sunday is the first real test. If withdrawals reopen on schedule and outflows stay orderly, Binance's promise that users will not bear the cost starts to look credible. A delay would hit confidence hard, so every update from the exchange will be read closely.

After that comes the full proof of reserves around 3 November, the final 10% of less liquid tokens, and the slow work of recovering frozen and laundered funds. Binance has also said its investigation found additional points of breach, without saying what they were, CNBC reported, so the full post-mortem is still to come.