Binance says it has already replaced 90% of the stolen funds
CEO Richard Teng says the exchange will cover the other 10% and is aiming to reopen withdrawals Nov. 1. Analysts at TRM Labs blame North Korea for the theft.
Binance has replaced 90% of the assets stolen in its Oct. 29 hack and will cover the remaining 10%, CEO Richard Teng wrote Saturday. Users, he said, will not bear the cost.
The exchange also released an updated proof of reserves, a tally of the funds that back customer balances, and says it is working to reopen withdrawals on Nov. 1. That is a goal, not a confirmed date. Withdrawals remain suspended for now, including for users in Mexico.
Binance's third incident update, which Teng cites, says the company set aside more than $6.34 billion of its own money to cover the losses. It had previously replaced about 80%.
The theft totaled about $6.36 billion across 10 blockchains, nearly all of it moved in roughly 20 minutes, according to TRM Labs. The blockchain analytics firm names TraderTraitor, a hacking group it ties to North Korea's government, and says it does so with "high confidence." It is a private firm's judgment; no authority has issued its own attribution.
As of Oct. 30, TRM counted about $2.7 billion frozen and about $2.4 billion still in the attacker's hands.
Binance has not published how the intruders got in. It first pointed to an engineer's compromised laptop, then acknowledged additional points of intrusion and promised a technical report once the investigation closes.
Binance is aiming to reopen withdrawals on Nov. 1.


