Binance says it has covered $6.34B in losses from security breach

Binance has committed more than $6.34 billion of its own funds to cover all losses from its recent security breach, the company said in a statement on Friday. That figure works out to roughly the entire market value of a mid-sized public company, deployed in weeks to make exchange users whole.

The exchange bought back the affected tokens through market and over-the-counter channels, it said. It funded the purchases with three sources: a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund above the level its risk framework requires, and its corporate treasury.

What does the buyback leave behind?

Binance has not said what its next steps in the process are — a notable silence given the scale of the payout. The company did commit to replenishing SAFU to roughly $1 billion, so the fund remains "fully resourced as an emergency user-protection reserve," according to its statement.

For context, $1 billion is about one-sixth of the amount just spent covering breach losses. Binance has also stated that user funds are safe.

The takeaway: Binance says its safety net is rebuilt, but it has disclosed no roadmap beyond that promise.

Can users verify their assets?

Binance took a new proof-of-reserves snapshot on November 12, 2026, covering 198 tokens. Once the zero-knowledge proof is generated — a process the company estimates at roughly 40 to 50 hours — users holding the affected tokens can verify their assets are backed at least one-to-one.

That verification window matters. A one-to-one backing claim is only as strong as the proof behind it, and users must wait two days after the snapshot to check it themselves.

In plain words: users get a cryptographic audit trail, but not an instant one.

Who was behind the attack?

Binance previously said the intrusion began with a compromised laptop belonging to a DevOps engineer. The attacker used that access to submit unauthorized withdrawal transactions.

The company said it found no evidence that wallet private keys were leaked. That distinction matters: a leaked private key would imply a deeper compromise of Binance's custody architecture than a hijacked employee machine.

United States authorities have attributed the attack to North Korea-linked hackers. Binance itself has not publicly named a perpetrator.

The takeaway: the entry point was human infrastructure, not broken cryptography — according to Binance's own account.

How much money has been recovered?

Binance said it engaged law enforcement and blockchain intelligence partners to trace and recover stolen funds. Working with blockchain partners, it froze affected assets on-chain, with about $3 billion frozen by early November.

That $3 billion is frozen, not returned — freezing prevents movement but does not by itself restore assets to users. Binance has not said when or whether frozen funds will be recovered and released.

When do withdrawals reopen?

Withdrawals are reopening in phases, Binance said, and the company will provide further updates once phases are confirmed. It gave no specific timeline for full restoration.

Until every phase completes, the $6.34 billion coverage remains a balance-sheet claim that users can only partially verify through the pending proof-of-reserves mechanism. The November 12 snapshot and the phased withdrawal reopenings are the next concrete checkpoints for anyone holding affected tokens on the exchange.