Visual China Group | Getty Images
Binance announced on Saturday that it covered up to 90% of the roughly $6.3 billion in token assets stolen from hot wallets in a record-breaking cryptocurrency theft announced on Thursday.
Binance said it will continue to purchase the remaining related token assets through the market and over-the-counter channels until the target amount of all tokens reaches 100%.
“All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are 100% fully backed,” Binance said in a statement. “Binance absorbs the economic impact of these stolen funds, not its users.”
The exchange said that 10% of the outstanding amount is made up of tokens outside of the top 10, and “due to low liquidity, it may take time to raise the required amount.”
Binance said it is leveraging the Safe Assets Fund for Users (SAFU), which is part of the Futures Insurance Fund, and the Corporate Treasury to replenish assets.
Binance said: “Our commitment remains unchanged. Binance will fully cover the financial consequences of the funds stolen in this incident. We will continue to demonstrate this commitment through tangible progress, transparent reporting, and concrete actions.”
While the exchange continues its investigation into the attack, its “next milestone” is to resume withdrawal services for users, subject to security checks, by Sunday, the exchange said.
Binance did not immediately respond to CNBC with further details or updates regarding the investigation.
It is not yet clear how the attack, the largest cryptocurrency theft in history, was carried out.
The world’s largest cryptocurrency exchange initially said the hack may have involved “compromising a DevOps engineer’s laptop, allowing attackers to access service containers and send fraudulent withdrawal transactions.” However, co-CEO Richard Teng later said the attack involved a more complex process than the abuse of a single engineer’s privileges.
It was also not clear who was responsible for the violation. However, blockchain intelligence and AI research firm TRM Labs pointed to North Korean hackers as a potential culprit.
“Several characteristics of this attack are consistent with previous North Korea-related heists, such as the Bybit hack and the April 2026 KelpDAO hack, including small Tornado Cash withdrawals that funded the operator’s wallet, staging that began well before the theft, and pre-captured signatures executed all at once,” the company said.
—CNBC’s Jenny Lee, Liz Napolitano and Davis Giangiulio contributed to this report.
