Binance says it has replaced 90% of the roughly $6.3 billion stolen from its hot wallets on Thursday, and that withdrawals, suspended since the attack, remain on track to reopen Sunday.
"Binance will absorb the financial impact of these stolen funds, not our users," the exchange said in its third recovery update on Saturday, adding that all BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are now "fully backed 100%." The remaining 10% sits in smaller tokens that Binance says are "less liquid" and will take longer to buy through the market and OTC desks.
The money is coming out of Binance's own pockets: a partial draw on its Secure Asset Fund for Users (SAFU), a slice of its futures insurance fund and its corporate treasury. On Friday the exchange said it had set aside more than $6.34 billion in company funds, $5 billion of it held in the exact tokens that were taken. Binance says it will refill SAFU to about $1 billion, and that its futures insurance fund remains above the level its risk rules require.
None of that is money recovered from the attacker. TRM Labs counted about $2.7 billion frozen as of late Thursday by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council, while the attacker still held more than 420,000 ETH and 18,270 BTC, worth roughly $2.4 billion, beyond any issuer's reach. Chainalysis puts the frozen total at about $2.8 billion; Binance says about $3 billion.
Both TRM and Chainalysis attribute the theft to TraderTraitor, the North Korean hacking unit the FBI blamed for the $1.5 billion Bybit hack in February 2025, as we reported. At roughly $6.36 billion by TRM's count, the Binance haul is about four times Bybit's. Binance itself has not named a culprit.
Binance's own account of how it happened has shifted. Its first update said the breach may have involved "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container." By Friday, it said the investigation "has uncovered additional points of breach," while adding that it has found no evidence wallet private keys were leaked.
Meanwhile, what's this?
TRM's on-chain analysis goes further. On Ethereum, the attacker used an EIP-7702 delegation backed by 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper it controlled, while Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers. "In TRM's assessment, this points to a compromise of Binance's hot wallet signing infrastructure," the firm wrote.
The attacker raced the freezes, selling about 325 million USDT to market makers for roughly 122,300 ETH at a discount of more than 10%, and borrowing ETH against USDT on Aave before Aave froze the affected markets. Chainalysis says the stolen funds are being cycled back and forth among addresses, and TRM expects the next leg to run through cross-chain bridges, swap services and OTC brokers.
Withdrawals will return in phases, subject to security checks. Binance took a fresh proof-of-reserves snapshot at midnight UTC on Saturday and says users holding the ten fully backed tokens will be able to verify their balances are at least 1:1 backed once the full zero-knowledge proof is generated, which it estimates by Tuesday.