Binance has replenished 90% of assets stolen in the $6.3 billion hack

After the partial resumption of withdrawals, Binance clients moved approximately US$ 4.6 billion (equivalent to about R$ 25 billion) in crypto assets on Sunday, the 1st. Of this amount, users withdrew US$ 3.64 billion (R$ 19.8 billion) more than they deposited, totaling a deposit of US$ 1 billion (R$ 5.44 billion).

Binance itself communicated through a post on X/Twitter that the net withdrawn amount corresponded to 2.1% of the assets held on the platform.

The exchange had been the victim of the largest hacker attack recorded in the cryptocurrency sector the previous Thursday, the 29th. In this incident, criminals managed to steal US$ 6.3 billion (R$ 34.2 billion) in cryptocurrencies.

Both the FBI and analysts pointed to North Korean hackers as responsible for the attack. In response to the losses, Binance announced that it mobilized US$ 6 billion (R$ 32.64 billion) to make compensation. This resource was obtained from the exchange's treasury, a specific insurance fund, and a reserve designated to cover security events.

The attack occurred around 5 PM, Brasília time, and lasted about twenty minutes, as evidenced by transaction records analyzed by experts. Initially, Binance suspected that the intruder had accessed one of its engineers' computers. Later, the company confirmed the discovery of security vulnerabilities that were exploited by cybercriminals.

According to TRM Labs, the hackers managed to compromise the system responsible for authorizing cryptocurrency transfers. A portion of the stolen funds was in stablecoins, which are designed to maintain a stable value, functioning as a reflection of global traditional currencies, such as the US dollar.

Founded in 2017 in Shanghai, China, Binance currently has 335 million registered global users, according to its most recent annual report released in 2025. This same report indicates that the company managed approximately US$ 162.8 billion (R$ 879 billion) in digital assets.

Micaella Ribeiro, co-founder of IAM Brasil and an expert in Information Security and Identity and Access Management, commented on the event in an interview with Olhar Digital, stating that the case demonstrates a significant shift in the landscape of digital threats. She emphasized that an attack on a cryptocurrency exchange does not necessarily imply that blockchain technology has been breached.

However, Ribeiro stressed that handling cryptocurrencies carries distinct risks. She pointed out that there is a difference between the security of blockchain technology and the security of the platforms used to trade, store, or buy these assets. For the expert, this attack underscores an alarming trend: criminals are focusing on compromising systems, devices, and identities that already have valid permissions to execute crucial operations.

Binance, the world's largest cryptocurrency exchange, announced that it used its own company funds to purchase replacement tokens, thereby covering $6 billion out of the total $6.3 billion stolen in a hacking attack. According to US officials, this hack was carried out by a state-sponsored North Korean group known as TraderTraitor.

On Saturday, Binance posted a message on X stating: 'We have covered $6 billion of the affected amount,' after previously reporting coverage of 90% of the stolen funds. According to Binance, the remaining amount, which is less than 10%, includes low-liquidity assets that may require more time to locate in the necessary volumes.

The US Federal Bureau of Investigation (FBI) confirmed on Saturday that the North Korean state group TraderTraitor is responsible for the attack. North Korea has long denied using state cyber units to generate income, commit financial theft, and conduct espionage. Representatives of the DPRK in Geneva and its embassy in China did not respond to requests for comment.

The FBI also stated in its announcement that law enforcement observed members of this group converting the stolen assets into Ethereum cryptocurrency and anticipates further laundering of these assets using associated technologies.

Previously, analysts blamed North Korea and suggested that this could be the largest financial robbery in history. Binance is cooperating with industry partners to freeze some of the affected assets, with about $3 billion discovered on Friday.

The company has repeatedly stated its readiness to assume the financial consequences related to the stolen funds. The funds spent on repurchasing tokens were taken from part of its Secure Asset Fund for Users (SAFU) amounting to $1 billion, which is a Bitcoin reserve to protect clients in case of security breaches, as well as from the futures insurance fund and the company's own corporate treasury.

Co-founder Yi He stated on Saturday that 50% of the SAFU funds would be used, while the company committed to replenishing the fund to approximately $1 billion. Following the hack, crypto prices fell on Friday, while Binance tried to reassure customers about the safety of their funds.

Co-founder Richard Teng previously described the hack as a 'sophisticated attack' involving a compromised laptop and malware designed to erase traces of its activity, which complicates the investigation. After the incident, the exchange suspended customer withdrawals, but on Saturday, it announced plans to resume withdrawals on Sunday. As of 02:50 GMT on Sunday, withdrawals had not yet been reopened.

Binance stated that it internally allocated approximately $6.34 billion in corporate funds to cover the losses. Furthermore, the company conducted a new snapshot of assets on its platform as of 00:00 GMT on October 31 as part of the reserve confirmation process. Users holding the 10 listed tokens—BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC—will be able to verify that their assets are backed at least 1:1 once full confirmation is available.

Hackers stole $6.3 billion (equivalent to approximately 33.71 billion Brazilian reais) from Binance, the world's largest cryptocurrency exchange. Analysts consider this incident the largest in the sector's history.

This incident caused a market drop, prompted industry companies to freeze some funds, and raised questions about the security of digital asset trading platforms.

According to the American blockchain analytics company TRM Labs, the attackers gained access to Binance wallets across 10 different networks and transferred the majority of the funds in about 20 minutes. The company linked this attack to North Korean groups, noting technical similarities with previous thefts attributed to Pyongyang, including the 2025 hack of the Bybit exchange, which was investigated by the FBI.

Chainalysis reported that it could not yet confirm the cause of the intrusion. By 9:30 AM Brazilian time, the company had identified at least $5.912 billion (approximately 31.63 billion Brazilian reais) in stolen assets.

Mark Karpeles, former head of the Mt. Gox exchange, told Reuters that Binance's assets appear to be distributed across different systems. He speculated that the hacker might have obtained valid authorization to move funds in certain platform systems and possibly even access to a private key.

Binance cooperated with partners to block the affected resources and managed to localize about $3 billion (16.05 billion Brazilian reais). Co-founder Yi He confirmed that the company would cover all losses resulting from the attack.

Other companies also participated in efforts to prevent the movement of funds. Binance's initial investigation showed that the breach might have started with the compromise of one engineer's computer. This access allowed the attacker to penetrate one of the exchange's systems and execute unauthorized withdrawals.

The company stated that user deposits were unaffected and expected to resume withdrawals within 48 hours after the attack. Binance also holds a customer protection fund composed entirely of Bitcoin.

For Kenneth Goh, Director of Private Capital Management at UOB Kay Hian, the attack on one of the world's largest exchanges should prompt investors to pay more attention to asset custody and platform responsibility in case of security failures.

The market reacted to the incident with decreased trading. Bitcoin fell by more than 3%, reaching a six-week low of $76,368. Ethereum also lost over 3%, dropping to $2,178. Coinbase shares fell by 4.8%, and Strategy shares dropped nearly 6% in extended trading in the United States.

Amanda He, Investment Director at ChainUp Investment, told Reuters that the initial drop might have been caused by the cryptocurrency being sold by the attacker himself. In her opinion, this step contributed to spreading investor concerns during the Asian session. She mentioned that her company sold positions held on Binance and converted the proceeds into stablecoins.

For Tim Sun, Senior Researcher at HashKey Group, the pause in deposits and withdrawals on Binance could negatively affect capital flow between platforms and impact market makers responsible for providing buy and sell prices to facilitate trades.

Liquidity concerns are also featured in assessments by Damon Xu, founder of 1Token. Commenting to Reuters, he predicted a reduction in strategies involving simultaneous operations across different exchanges and the use of leverage, which allows trading with borrowed funds. Xu believes that decentralized platforms may benefit from potential capital and commercial activity shifts.

Jeff Ko, Lead Analyst at ViaBTC, assessed to Reuters that Bitcoin might face less selling pressure because its transactions are tracked on the blockchain, making it difficult to move stolen funds without leaving traces. Ethereum, conversely, might experience greater pressure due to the availability of tools that facilitate obscuring transaction origins.