Binance says it rebuilt most of what a hacker took. The exchange raised its count from 80% Friday morning to 90% by Friday afternoon. That covers $5.67 billion of the $6.3 billion stolen Oct. 291. The FBI named a suspect the same day. North Korea did it, the bureau said, blaming a unit it calls TraderTraitor5. Two days passed between the theft and the FBI's alert. The bureau took five days to blame North Korea for last year's Bybit hack, a smaller theft the same tracing firms worked7.
Binance@binance
Teng Posts the Number Himself
Richard Teng posted the update on his own account, three minutes after Binance's own feed linked it23. His message carried numbers instead of jokes. "We know how important trust is, especially in moments like this," Teng wrote on X at 14:33 UTC. “We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident,” he added. The same post named Sunday, Nov. 1, for the return of withdrawals.
Binance's co-chief executive has run the exchange day to day since 2023, when founder Changpeng Zhao stepped back. Teng built his career at regulators first. He led Abu Dhabi Global Market's financial watchdog before he joined Binance in 202112. That background shaped Saturday's post. A percentage opened it, a date closed it, and a link to the proof sat in between.
What 90% Actually Covers
Binance's 90% rests on three pools of money. The exchange tapped its corporate treasury first. A portion of its Secure Asset Fund for Users followed, built for exactly this kind of loss. Its futures insurance fund supplied the rest14. Ten assets now sit fully backed: bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, Binance said.
Binance Replaces $5.67B of the $6.3B Stolen Oct. 29, 90% as of Oct. 31
Dollars replenished versus still open, out of the $6.3 billion Binance says was stolen
- Replenished: $5.67B
- Still open: $0.63B
- Each square is $0.63B
Source: CoinDesk [1].
Read the chart as a table
| Item | Value |
|---|---|
| Replenished | $5.67B |
| Still open | $0.63B |
| Whole | $6.30B, each square $0.63B |
The remaining 10%, $0.63 billion, sits in smaller, less liquid tokens outside that list1. Binance set aside $6.34 billion in total. Partners such as Tether and Circle had already frozen close to $3 billion of the stolen funds. Binance plans to rebuild SAFU itself to about $1 billion as the recovery continues. Five freezes, three funding pools and one public count built Saturday's 90%.
Proving that figure will take longer than announcing it. A zero-knowledge proof lets a reader check a balance is real while every other account stays hidden. Binance says generating one for its full reserves needs 40 to 50 hours of computing time. The exchange expects the proof ready by Nov. 3, two days after withdrawals resume9.
Binance framed Saturday's update as one step in a longer process. “Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the exchange said in a statement to CNBC. “We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions,” it added4.
FBI Moves Faster Than It Did for Bybit
The FBI released its own alert Saturday. “The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the bureau wrote. “The FBI refers to this specific North Korean malicious cyber activity as 'TraderTraitor,'” it added5.
SolanaFloor@SolanaFloorNEW: The FBI says North Korea was responsible for the $6B+ @Binance hack. pic.twitter.com/nechKQYScN
Secret Service agents and the IRS's Criminal Investigation division worked the case alongside the FBI. Together the three agencies traced the stolen money moving mostly into ether, headed next for DeFi platforms and instant-swap services5. TraderTraitor sits inside North Korea's wider state hacking program, the same program security researchers tied to the Bybit theft.
Speed set Saturday's alert apart. Two days separated the theft from the FBI's public word on who did it. Five days passed before the bureau named North Korea for last year's $1.5 billion Bybit hack. The blockchain tracing firm TRM Labs worked that case too7. TRM called its Binance finding a matter of "high confidence" a day before the FBI's own alert matched it. The firm had already flagged 628 wallet addresses for exchanges to block. Partners had frozen 42% of the stolen funds through that list alone.
Binance's Count Hit 90% the Same Day the FBI Named North Korea, Oct. 31, 2026
Three days of the Binance hack, Oct. 29 to 31, 2026, by recovery count and FBI timing
Read the chart as a table
| Date | Event |
|---|---|
| Oct. 29, 2026 | Binance hot wallets lose $6.3B |
| Oct. 30, 2026 | Binance says 80% replenished |
| Oct. 31, 2026 | FBI names North Korea; Binance hits 90% |
A Case That Still Rests on Trust
One security researcher wants more before he calls the file closed. Robert Coles studies threats for the firm Black Duck. He read the North Korea case with care. “There are certainly indicators pointing toward North Korea, particularly given the history of targeting cryptocurrency organizations, but I'd like to see more of the technical details around the intrusion before drawing any firm conclusions,” Coles said6. He raised a separate caution about speed. “I'd also be careful about getting too far ahead of the investigation on attribution,” he added. Four years of past North Korean raids built the pattern investigators now trust. A pattern still stops short of a name on a charge sheet.
Coles pressed past the question of who did it. “The bigger question is what happened after that initial access and why the controls in place weren't enough to stop it from becoming a much larger incident,” he said6. A compromised laptop opened the breach, by Binance's own early account. Coles wants to know why that single opening grew into a loss worth billions.
CertiK, a blockchain security firm, raised a separate question. It told Cointelegraph it needed more detail to check Binance's own $5 billion figure8. Binance's reserve snapshot already sits on its website. The cryptographic proof behind that snapshot still needs generating. Readers can check it starting Nov. 3, two days after withdrawals restart9.
Markets showed some of that same hesitation. US spot bitcoin funds lost $643 million on Oct. 30, the day after the hack, reversing four days of gains. BlackRock's iShares Bitcoin Trust alone shed about $234 million, and Fidelity's Wise Origin Bitcoin Fund shed about $201 million10. Ether funds lost another $156 million the same day. Binance's own token held steady through the recovery news. BNB traded at $702.22 at 22:54 UTC on Oct. 31, CoinGecko's feed showed11.
Saturday closed with two claims and zero outside proof behind either one. Binance's reserve count and the FBI's suspect both rest on evidence their own authors control. Nov. 3 is the date both claims meet a check an outside party writes.
By the numbers
- Binance raised its recovery count from 80% to 90% of the $6.3 billion stolen, reported by 15:24 UTC on Oct. 311.
- $5.67 billion of the theft is now replenished, Binance says, against $630 million still open1.
- Binance set aside $6.34 billion total, drawn from its treasury, SAFU and futures insurance fund1.
- Partners including Tether and Circle had frozen close to $3 billion of the stolen funds1.
- Two days passed between the theft and the FBI's attribution, against five days for last year's Bybit hack7.
- The full cryptographic proof of Binance's 90% figure is expected by Nov. 3, 40 to 50 hours after generation begins9.
- US spot bitcoin ETFs lost $643 million on Oct. 30, reversing four days of inflows10.
- BNB traded at $702.22 at 22:54 UTC on Oct. 31, little changed through the week's news11.
What to watch
Binance's zero-knowledge proof lands Nov. 3. It will show whether independent math backs the 90% figure or leaves gaps CertiK and other auditors still want closed. Withdrawals are set to resume Sunday, Nov. 1, the first real test of Binance's promise. A criminal charge or a filing naming an individual would turn the FBI's TraderTraitor label into a case with a defendant. Bitcoin ETF flows next week will say whether investors who pulled back Oct. 30 came back once the recovery math improved.
Sources
- Francisco Rodrigues, "Binance says it has replaced 90% of stolen crypto after massive $6.3 billion breach," CoinDesk, Oct. 31, 2026, https://www.coindesk.com/business/2026/10/31/binance-says-it-has-replaced-90-of-stolen-crypto-after-massive-usd6-3-billion-breach
- Binance, "Security Incident," post on X, Oct. 31, 2026, https://x.com/binance/status/2116538196259684457
- Richard Teng, "We know how important trust is, especially in moments like this.," post on X, Oct. 31, 2026, https://x.com/_RichardTeng/status/2116538946188726474
- Michael Wayland, "Binance says 90% of $6.3 billion hack losses are now covered, plans to resume withdrawals Sunday," CNBC, Oct. 31, 2026, https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html
- SolanaFloor, "North Korea Responsible for $6 Billion+ Binance Attack," post on X, Oct. 31, 2026, https://x.com/SolanaFloor/status/2116644876737814890
- Cam Sivesind, "$6.3B Binance Heist: One Breach, 10 Chains, 20 Minutes," SecureWorld, Oct. 31, 2026, https://www.secureworld.io/industry-news/binance-6.3b-heist-breach
- Gennaro Cuofano, "FBI Ties $6B Binance Hack to North Korea in Two Days," FourWeekMBA, Oct. 31, 2026, https://fourweekmba.com/ai-fbi-ties-6b-binance-hack-to-north-korea-in-two-days/
- Bryan O'Shea, "Binance Says 90% of Assets Replenished After $6.3B Hack," Cointelegraph, Oct. 31, 2026, https://cointelegraph.com/news/binance-hack-90-percent-replenished
- Camila Reyes, "Binance Says Hack-Loss Coverage Reaches 90% With New Reserve Snapshot," securities.io, Oct. 31, 2026, https://www.securities.io/binance-says-hack-loss-coverage-reaches-90-with-new-reserve-snapshot/
- Vivian Nguyen, "Spot Bitcoin ETFs Shed $643 Million in a Day as Ethereum Funds Lose $156 Million," Crypto Briefing, Oct. 31, 2026, https://cryptobriefing.com/spot-bitcoin-etfs-643-million-outflows/
- CoinGecko, "Binance Coin (BNB) price in US dollars," Oct. 31, 2026, https://api.coingecko.com/api/v3/simple/price?ids=binancecoin&vs_currencies=usd
- "Richard Teng: the former Abu Dhabi financial regulator named as new Binance chief," The National, Nov. 22, 2023, https://www.thenationalnews.com/business/cryptocurrencies/2023/11/22/who-is-new-binance-chief-executive-richard-teng/