Binance, the world’s largest crypto exchange by daily trading volumes, confirmed it has covered 90% of the stolen amount, which totaled approximately $6.3 billion. In a statement, the exchange said it set aside around $6.34 billion of company funds internally to cover the losses. This replenishment involved the partial deployment of its $1 billion Secure Asset Fund for Users (SAFU), a Bitcoin reserve held to protect customers during security breaches. The remaining 10% of the stolen assets consists of less-liquid tokens, which Binance noted may take longer to source in the required quantities.
The FBI said it observed TraderTraitor actors converting the stolen assets into Ethereum. The bureau expects these assets will be further laundered using decentralized finance (DeFi) and instant swap services. To mitigate this, the FBI, in coordination with the US Secret Service and the IRS Criminal Investigation division, urged private sector entities to block transactions with or derived from specific addresses used by the hackers. A list of these addresses was published by the bureau. The agency specifically called on THORChain node operators, RPC providers, exchange services, DeFi platforms, and blockchain analytics companies to implement these blocks.
Binance co-CEO Richard Teng described the incident as a “complex attack” on Friday. He explained that the breach involved a compromised laptop and malicious software designed to delete evidence, making tracing and investigation more difficult. Following the incident, which caused sharp declines in major cryptocurrency prices on Friday, Binance conducted a new snapshot of assets held on its platform as of 2:00 a.m. Israel time on October 31. This step is part of its proof-of-reserves process. Users holding ten listed tokens—including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC—will be able to verify that their assets are backed at a minimum 1:1 ratio once the full proof is available.
The exchange stated it remains on track to resume withdrawal services on Sunday, November 1, within its previously stated timeframe. The FBI’s statement marks a significant regulatory and security milestone, formally linking the massive asset drain to state-sponsored cyber activity and prompting a coordinated response from the global virtual asset ecosystem.
