Richard Teng, co-CEO of Binance, announced that it can compensate most of the losses to users in the hack, currently blamed by the FBI on North Korean hackers.

"We have replenished 90% of the stolen assets and are committed to compensating for the missing 10%. Users will not suffer financial losses from this incident," Teng wrote on X on October 31.

According to Reuters, Binance digital currency exchange compensates 90% of lost assets by buying new tokens, the remaining 10% consists of tokens with less liquidity, which can take longer to buy.

The money used to buy back tokens comes from Secure Asset Fund for Users (SAFU), Futures Insurance Fund (FIF) and the company's own treasury. SAFU was established by Binance in 2018 to protect users in emergency situations, currently holding about one billion USD worth of Bitcoin.

The Binance hack on October 29 was considered the largest scale in the history of digital currency exchanges with an estimated 6.3 billion USD stolen. Binance initially believed that the hack may have originated from a compromised DevOps engineer's laptop, but on October 30 announced the discovery of additional intrusion points.

Some blockchain analysis companies commented that the hack had many similarities with previous activities believed to have been carried out by North Korean hackers. Two companies, TRM Labs and Chainalysis, both believe that the culprit is the North Korean hacker group TraderTraitor.

By October 31, the US Federal Bureau of Investigation (FBI) also named TraderTraitor. The agency stated: "The FBI released information indicating that North Korea is responsible for the theft of more than $6 billion in virtual assets from the Binance cryptocurrency exchange on or about October 29, 2026."

According to Guardian, the FBI discovered that TraderTraitor transferred stolen assets to Ethereum cryptocurrency, predicting that the hacker group will continue to launder these funds by converting them through decentralized financial services and instant swaps. The FBI is calling on private entities to block transactions to or from addresses used by TraderTraitor to launder money.

After the attack, Binance stopped allowing customers to withdraw funds, but said it could reopen the service on November 1.

According to an investigation by data analysis company TRM Labs, hackers penetrated Binance's "signing infrastructure" - the system that approves transactions, allowing them to issue withdrawal orders from affected wallets. Blockchain data shows that most of the money was withdrawn in about 20 minutes, starting at 8:05 p.m. on October 29 (3:00 a.m. on October 30, Hanoi time), including Ethereum, Bitcoin, Tron, Solana, and transferred to many addresses controlled by the same attack group.

Although the hack was serious, the damage was still small compared to the size of Binance's total assets. According to blockchain data analysis firm Nansen, the exchange's wallets hold a total of $167 billion in crypto assets, including user funds, Binance's own assets, and reserves in the SAFU fund. Additionally, Binance also owns a number of assets that are not included in the blockchain data.

Binance said that after adding funds from reserves to hot wallets, users' cryptocurrency balances will not change. "We will weather this storm," a spokesperson told theWall Street Journal.

Thu Thao summary