Key facts
- Binance said it covered 95% of stolen assets and was still sourcing the remainder, which it called less liquid.
- Binance said it set aside about $6.34 billion of company funds to cover losses from the breach.
- Binance co-chief executive Richard Teng said users would not bear the financial impact of the hack.
- The FBI said TraderTraitor actors converted stolen assets mainly into ether and warned of further laundering.
- Binance said bitcoin deposits and withdrawals remained partially suspended as of Sunday morning.
- Binance said it will publish a detailed incident report once its investigation is complete.
Binance said early on Sunday, November 1 that it would begin allowing customer withdrawals in phases, after hackers stole $6.3 billion worth of crypto from Binance wallets. The exchange had frozen all deposits and withdrawals following the breach on October 29.
In its update, Binance said it had covered 95% of the stolen assets and was still working to buy the remaining affected assets, which it described as less liquid in the market and slower to source at the required scale. An earlier Binance statement on October 31 put the replenishment at 90%. The company said it set aside about $6.34 billion of its own funds to cover losses, drawing on its $1 billion Secure Asset Fund for Users, part of its Futures Insurance Fund and its corporate treasury.
"Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds," the company said. "These losses will not be passed on to users." Co-chief executive Richard Teng also said users would not bear the impact of the hack.
Binance said the freeze was a precaution while teams worked to contain the incident loss, assess its impact, restore affected services and complete security checks. Withdrawals resumed in phases depending on network and asset type, with ether, USDT and USDC on the Ethereum blockchain available first, followed by some assets on the BNB Smart Chain and AVAX later in the day. As of Sunday morning, Binance's network status page showed a mix of normal, partially suspended and fully suspended statuses, with bitcoin deposits and withdrawals still partially suspended and ethereum deposits normal but withdrawals partially suspended. The company said users should expect temporary delays or longer processing times due to traffic volume.
Binance previously blamed North Korean hackers for the breach. On Saturday, the FBI said a North Korean group known as TraderTraitor was responsible and that the group was converting the assets primarily into ether, with further laundering likely. Binance said it will publish a more in-depth incident report when its investigation is complete.