Binance replaces $6.34bn in stolen tokens from its own funds after record hack
Binance has replaced the $6.34 billion of customer tokens drained in the Oct. 29 hack using its own money, the exchange said on Thursday, two weeks after the largest crypto theft on record. The move restores affected balances, but it does not mean the stolen coins have been recovered from the attackers.
The exchange said it bought the affected tokens through market and over-the-counter channels, drawing on a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund above the level required under its risk-management framework, and its corporate treasury. It has committed to replenishing SAFU to about $1 billion after the partial draw. A very small number of tokens Binance no longer lists were also affected; the exchange said those holdings will be handled under its delisting process and that users who hold them will be covered.
Binance also published a new proof-of-reserves snapshot taken at 00:00 UTC on Nov. 12, covering 198 tokens, up from 10 in the Oct. 31 snapshot. The exchange said the full zero-knowledge proof will take about 40 to 50 hours to generate because of the computational workload, after which users holding affected tokens “will be able to independently verify that their assets are backed at a minimum of 1:1.” Until then, the 1:1 backing is Binance’s statement, not something customers can confirm on their own.
Withdrawals continue to reopen in phases, and Binance said it will share further details once they are confirmed. The exchange first reopened withdrawals on Nov. 1, starting with bitcoin and then expanding to other networks. Thursday’s announcement did not say how much of the stolen assets have been retrieved and did not name an attacker. The theft, which Binance first detailed in a Nov. 3 incident report, began with a fake job interview and a poisoned developer tool and drained hot wallets on Oct. 29. Binance had already pledged more than $6.34 billion to cover customer losses in the hours after the breach, reported coverage of 90% and then 95% as it reopened withdrawals, and later said it had replenished 98% of affected tokens, with the remainder in less liquid assets that took longer to buy. Thursday’s statement is the first time Binance has said that process is complete.
What it means for Pakistan: Pakistani users of Binance, one of the most widely used exchanges in the country, face two immediate tests: whether the zero-knowledge proof due in about two days backs the new snapshot, and how quickly the remaining withdrawal queues clear. The incident also sharpens the case for the virtual-asset rules Pakistan is still developing, since the fake-job-interview and poisoned-tool attack that drained hot wallets targeted developer access rather than customer accounts, a risk that local exchanges and their security teams will need to address as licensing under the new regime takes shape.
