Key facts
- Changpeng Zhao said Binance did not borrow, sell assets or raise money to cover the loss.
- Binance traced the breach to a compromised DevOps engineer's laptop and said no private keys leaked.
- Binance drew on its Secure Asset Fund for Users, part of its Futures insurance fund and corporate treasury.
- Co-founder Yi He confirmed the withdrawal re-enablement timeline in a post on X.
- Binance data showed hourly deposits began to exceed withdrawals after the resumption began.
Binance founder Changpeng Zhao said in a post on X on November 2 that the exchange covered a $6.3 billion hack entirely from its own balance sheet. "Binance did not borrow money. Binance did not sell assets. Binance did not raise money. Binance covered from its balance sheet," he wrote.
The theft occurred on October 29, 2026, when attackers drained funds across roughly ten networks in under 30 minutes. Blockchain analytics firms Chainalysis and TRM Labs attributed the breach to North Korea's Lazarus Group.
Binance said its initial investigation traced the breach to a compromised DevOps engineer's laptop and that no private keys were leaked. The exchange drew on its Secure Asset Fund for Users, a portion of its Futures insurance fund and corporate treasury to cover the losses.
Stablecoin issuers moved to freeze funds. Tether froze approximately $1.57 billion in USDT, Circle blocked over $800 million in USDC and Ripple froze $200 million in RLUSD.
By October 31, Binance said it had replenished roughly 90% of impacted funds, with BTC, ETH, USDT, BNB, SOL, USDC and XRP at full backing. Zhao's November 2 update said the allocation was complete, with only minor conversions of smaller, less-liquid tokens remaining.
Binance began a phased resumption of withdrawals across nine networks, restoring ETH-based assets including LINK and SHIB. Co-founder Yi He confirmed the re-enablement timeline on X. Binance data showed hourly deposits began to exceed withdrawals, and Zhao said most outflows went to self-custody wallets rather than competing exchanges.