Binance replaces 90% of stolen crypto, eyes Sunday reopen

Binance said Saturday it has replenished about 90% of the roughly $6.3 billion in crypto stolen in Thursday’s record-setting breach and took a new proof-of-reserves snapshot at 00:00 UTC, while targeting Sunday, Nov. 1, to resume withdrawals, according to its latest recovery update and outside reporting. The company reiterated that “Binance will absorb the financial impact of these stolen funds, not our users,” and listed ten fully backed tokens as of today’s tally, up from 80% coverage in an earlier notice, with the remainder in less-liquid assets it is repurchasing via markets and OTC deals (Binance, CoinDesk). The new snapshot was captured at 8 p.m. ET Friday, with a full zero-knowledge proof of reserves expected around Nov. 3 (UTC), as investigators and law enforcement continue tracing funds frozen by partners, which remain immobilized but not returned (Binance, BBC live).

Separately, blockchain analytics firms TRM Labs and Chainalysis identified North Korea’s state-backed Lazarus Group, also known as TraderTraitor, “with high confidence” as the likely culprit, while Binance has not publicly attributed the attack and did not directly respond to questions about potential North Korean links, according to the BBC’s reporting today. U.S. authorities, including the Secret Service, are assisting in tracking the stolen funds, as analysts describe novel laundering patterns in what Binance’s co-CEO called a “complex attack” that initially appeared limited to a compromised laptop before the inquiry widened to additional breach points (BBC, BBC live).

What changed today?

The most significant change is Binance’s move from 80% to about 90% replenishment of the stolen sum, coupled with confirmation that ten major tokens are fully backed and a new proof-of-reserves snapshot has been taken, providing a more current view of balances after the breach and subsequent topping-up process (CoinDesk, Binance). Binance also set a target of Sunday, Nov. 1, for restarting withdrawals. That is a target, not a confirmed time, and the company has not said what hour withdrawals could resume (Reuters via CNA, Binance).

How is the recovery being funded?

Binance says it has set aside more than $6.34 billion in company funds, including partial use of its roughly $1 billion SAFU emergency fund, to ensure users do not bear the loss, reiterating, “Binance will absorb the financial impact of these stolen funds, not our users” (CoinDesk, Binance). The company says the remaining roughly 10% of assets are tied up in less-liquid tokens it is actively buying in the public markets and through OTC trades, while about $3 billion has been frozen by partners pending further legal or technical processes, though frozen funds are not the same as recovered funds at this stage (Reuters via CNA, CoinDesk).

What do we know about the attack itself?

Co-CEO Richard Teng described it as a “complex attack” that initially appeared to hinge on a compromised laptop and malware that deleted evidence, before investigators uncovered “additional points of breach,” indicating a broader intrusion than first understood (Reuters via CNA, BBC). TRM Labs said the attacker likely gained access to Binance’s hot wallet signing system and used a special authorization to transform a Binance hot wallet into one that automatically moved funds to the attacker, a method that Chainalysis says came with laundering patterns “we have not seen before,” complicating immediate tracing and recovery efforts (BBC, BBC live).

Is there attribution to a specific group?

While Binance has not publicly attributed the hack, TRM Labs and Chainalysis told the BBC they identified the North Korean state-backed Lazarus Group, also known as TraderTraitor, “with high confidence,” echoing prior concerns over DPRK-linked activity across the crypto ecosystem, though formal government attribution in this case has not been announced (BBC, BBC live). The BBC also noted the FBI’s past statements on North Korean involvement in major exchange thefts by other platforms, while North Korea has long denied cybercrime accusations, underscoring the sensitivity of assigning blame without official determinations here (BBC, AP).

What does this mean for users right now?

For now, withdrawals remain paused as the exchange works toward its Sunday target, and Binance has highlighted that key assets including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed today, with purchases of less-liquid tokens continuing, according to the company’s update (Binance, Reuters via CNA). AP reported that bitcoin fell after Binance first flagged a “potential security issue” and paused withdrawals; NewsCubby’s earlier briefing covers that initial pause and the frozen funds (AP, NewsCubby briefing).

What we know

We know Binance pegs the incident at about $6.3 billion, the largest crypto theft on record, and says it has already replaced about 90% of the stolen amount using company funds, with ten named tokens fully backed and a new proof-of-reserves snapshot taken at 00:00 UTC today to reflect current balances after replenishments and freezes by partners totaling about $3 billion, though those remain immobilized and not yet recovered to Binance accounts (CoinDesk, Binance).

What we don’t know yet

We don’t know the exact time withdrawals will restart Sunday, whether all remaining less-liquid tokens will be fully repurchased by then, how much of the roughly $3 billion in frozen assets can ultimately be recovered, or whether governments will issue formal attribution to a specific actor beyond the high-confidence assessments from analytics firms shared with the BBC today (Binance, BBC).

What’s next

Binance says it is working toward publishing a full zero-knowledge proof of reserves around Nov. 3 (UTC), while it works toward its Sunday, Nov. 1, target for resuming withdrawals (Binance, Reuters via CNA). Investigations continue with assistance from partners and U.S. authorities tracking funds in motion and frozen pools, even as analytics firms say the laundering patterns defy easy comparisons to past cases, making timelines for any asset returns uncertain for now (BBC live, BBC).

*Want more? Explore today's headlines on NewsCubby and join My Day free to make NewsCubby part of your day.*

*ARCHIVE PHOTO: A bitcoin token on a laptop keyboard, February 2023. Not the current event. Photo: Satheesh Sankaran / Wikimedia Commons / CC BY 2.0 (cropped).*

*NewsCubby articles are produced with AI assistance and reviewed by humans.*