Binance Says It Will Absorb a $6.3 Billion Theft. What That Rests On

In short: Binance has replaced most of the roughly $6.3 billion stolen from it on 29 October, and says its users will not bear any of the loss. That is a strong outcome for customers this time. But the guarantee comes from Binance's own balance sheet and a fund it controls, not from insurance or a legal requirement. A custodial balance is a claim on its operator, and this episode shows how much that matters.

What happened

On 29 October, roughly $6.3 billion in crypto assets left Binance's hot wallets. TRM Labs counted about $6.36 billion moved across ten blockchains, starting at 20:05 UTC and mostly within about 20 minutes. Estimates of the total differ slightly by source and by the prices used to value the assets.

The FBI attributed the theft to North Korea's TraderTraitor group. North Korea denied it; Kim Yo Jong called the claim "absurd rhetoric and nothing new". The entry point was social engineering: NPR reported that an engineer was approached by someone posing as a "project director" and, after staged interviews, downloaded an assignment containing malicious code. Bloomberg reported, as summarised by OODAloop, that the attackers paid about $15 in network fees to move roughly $2.5 billion in a single transfer.

The promise, and how it is funded

Binance's 31 October update stated: "Binance will absorb the financial impact of these stolen funds, not our users." It named three sources of funds:

1. A partial deployment of the Secure Asset Fund for Users (SAFU)
2. A portion of the futures insurance fund; Binance said the remaining balance "is a regulatory requirement"
3. Binance's own corporate treasury

The coverage figure then rose quickly:

Binance has not published how much came from each source. Its 1 November update repeated that "these losses will not be passed on to users," and the 4 November update referred only to its own resources.

"Covered" does not mean recovered. As CNBC put it, restoring backing for 90% of the assets "doesn't mean it has recovered 90% of the funds from the attacker." Binance refilled customer balances from its own money while the stolen assets were still being traced.

What SAFU is, and what it is not

Binance's SAFU FAQ said that "as of February 2026, SAFU holds crypto assets valued at approximately US$1 billion." The fund is held and managed by Nest Clearing and Custody Limited, which the FAQ describes as a Recognized Clearing House. Two clauses define its limits:

• "Binance retains full discretion to determine what types of loss and which claims are eligible for recovery from SAFU."
• "Binance may also change the intended use of SAFU funds from time to time at its discretion."

By our arithmetic, a $1 billion fund is about a sixth of a $6.3 billion loss. It was never sized to cover an event like this alone, and it has been drawn down: Cointelegraph reported that the fund's bitcoin wallet fell from about 15,000 BTC to about 7,500 BTC after a transfer of 7,499 BTC that Binance linked to the partial deployment. Binance has committed to replenish SAFU to about $1 billion.

The rest came from Binance itself. That is why the promise could be kept: Binance had enough corporate resources. It is also why the promise is only as strong as those resources.

Not a bank deposit

A bank deposit up to the insured limit is backed by a government scheme. Crypto held on an exchange is not; deposit insurance does not cover crypto assets. NPR reported that Binance is "not necessarily bound" to repay customers under current regulations. Amanda Fischer of Better Markets told NPR that US brokers, by contrast, have to pay for insurance meant to make customers whole after a cyberattack.

Binance's main regulator, Abu Dhabi's Financial Services Regulatory Authority, said it was "engaging closely with Binance and monitoring the incident." We found no regulator statement requiring Binance to repay customers.

The withdrawals test

Binance suspended withdrawals after the theft and began reopening them in phases on 1 November, with the first phase scheduled between 06:00 and 09:00 UTC. The first hours were the real test of confidence. The Block reported that Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits in about nine and a half hours, a net outflow of about $3.64 billion. Binance put that at 2.1% of its $171 billion in assets, based on proof-of-reserves data from 28 October.

By early 3 November, cumulative net outflows were $5.28 billion, according to data shared by co-CEO Richard Teng, who said hourly deposits had begun to exceed withdrawals. Other trackers report higher figures over different windows and wallet sets, so the totals are not directly comparable.

Meeting withdrawals of that size within days depends on holding liquid assets against customer balances, the same question banks face in a run.

What proof of reserves shows

Binance took a proof-of-reserves snapshot at 00:00 UTC on 31 October, covering ten tokens, and later generated a zero-knowledge proof so users could "independently verify that their balances on Binance are backed at a minimum of 1:1." A second snapshot on 4 November covered 44 tokens.

That is useful, and narrow. It shows that at one moment Binance held at least as much of each covered token as users' recorded balances. It does not show Binance's other liabilities, its corporate finances, or its capacity to absorb a future loss. The independent audit Binance cites relates to the proof-of-reserves code, linked to a 2023 review, not to the snapshot itself.

Getting the money back is a separate track

Recovering stolen assets runs alongside Binance's replenishment, not instead of it. Elliptic had verified $2.85 billion of frozen or seized funds, 44% of the theft, as of 1 November. Binance has already restored customer balances from its own funds; the frozen assets remain subject to that separate recovery process.

Binance has promised a post-incident report once its investigation is complete, and Teng said the company is bringing in an independent expert to review its response.

The lesson for any custodial account

For an account holder, what matters is not the size of a theft but who stands behind the balance. At a bank, part of the answer is deposit insurance. At a crypto exchange, it is the exchange's own reserves and its willingness to use them. Binance had the resources, and used them, this time. The same question applies to any app that holds money on a customer's behalf, and it is the theme that runs through Banking & Neobanks.