Binance has completed coverage of assets affected by its security incident, after committing more than $6.34 billion in company funds to cover the losses.
In a statement on Friday, Binance said it bought back affected tokens through market and over-the-counter (OTC) channels, funded by a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund above the level its risk framework requires, and its corporate treasury.
Binance does not mention its next steps in the process.
The company says it will replenish SAFU to about $1 billion, so that it remains “fully resourced as an emergency user-protection reserve.” Binance has also said that user funds are safe.
Binance has taken a new proof-of-reserves (POR) snapshot on November 12, 2026, covering 198 tokens. Once the full zero-knowledge proof is generated, after about 40-50 hours, users holding the affected tokens can verify that their assets are backed at least one-to-one.
Previously, Binance said that the attack involved a compromised laptop belonging to a DevOps engineer. This allowed an attacker to submit unauthorized withdrawal transactions. The company said it found no evidence that wallet private keys were leaked.
The United States authorities have attributed the attack to North Korea-linked hackers.
On recovery, Binance has said it has engaged law enforcement and blockchain intelligence partners to trace and recover funds. It has worked with blockchain partners to freeze affected assets, with about $3 billion frozen on-chain by early November.
Binance says withdrawals are reopening in phases and that it will give further updates once they are confirmed.
Binance vows to cover all losses from security breach, estimated at $6.3B

