Binance's statement is carefully worded, and the wording is the story.

The exchange said on Saturday that it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets on Thursday. Covered is not recovered. Binance is not telling users it got the money back from the attacker; it is telling them it bought replacement tokens with company money, at market and over the counter, and put them back where they belong.

"All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%," the company said. "Binance will absorb the financial impact of these stolen funds, not our users."

The outstanding 10% is the interesting part. It consists of tokens outside that top ten that are "less liquid, which means they may take longer to source in the required amounts." Binance said it will keep buying through market and OTC channels until coverage reaches 100% for every token.

The money is coming from three places: the Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund, and its corporate treasury. That is what a well-capitalised exchange looks like when it has to perform — and also a reminder that the insurance layer users were told about is now doing real work.

Sunday is the behavioural test

Binance says withdrawals reopen by Sunday, "subject to security checks and final confirmation." Coverage is an accounting claim; a withdrawal queue is a behavioural one. An exchange that has just disclosed a multi-billion-dollar hole is making a promise about liquidity, not only solvency, and the market will price that promise the moment the doors open.

What is still unexplained

The bulk of the theft unfolded in about 20 minutes late on Thursday. Binance initially pointed to a compromised DevOps engineer's laptop that gave an attacker access to a service container and the systems used to process withdrawals. Co-CEO Richard Teng later described a more complex attack than one engineer's permissions, and the company found additional breaches; software designed to erase traces hampered the investigation, according to Reuters.

Attribution points to North Korea. Blockchain intelligence firms TRM Labs and Chainalysis both flagged similarities to earlier state-linked heists — the Bybit hack and the April 2026 KelpDAO incident — including small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. Pyongyang routinely denies involvement and its Geneva mission did not respond to questions.

The freeze race

The reason the number is 90% and not 100% is that Binance chose to buy rather than wait for law enforcement. Issuers moved fast on what could be moved: Tether said it froze nearly $1.57 billion linked to Binance, and Circle froze $800 million. Public trackers put total frozen assets at roughly $2.7–3 billion. Bitcoin and ether cannot be frozen at all, because no single entity controls them, and Chainalysis said the launderers were using patterns it had not seen before.

The FBI and the US Secret Service are assisting the investigation, a sign of how far crypto has moved into the financial mainstream — and how much the stakes have risen now that it is there.

The industry's answer is a club

Rivals did not wait. Coinbase took systems that store cryptocurrency keys offline "solely out of an abundance of caution"; Kraken said it monitors industry incidents for lessons it can apply. OKX CEO Star Xu went further, calling for a coordinated detection network: "We need a real-time alert system that allows participants to share information immediately when a hack occurs, coordinate a rapid response, and temporarily freeze suspected stolen funds."

That is the unremarked irony of the week. Crypto spent a decade arguing it did not need the circuit breakers of traditional finance. Confronted with a genuine systemic shock, its own chief executives asked for a shared alert network and a mutual freeze protocol — the plumbing of a club with members, not of a permissionless market.

What to watch

Two numbers: how much of the remaining 10% gets sourced, and how large the withdrawal queue is on Sunday and Monday. Bitcoin fell more than 4% and ether more than 5% on Thursday before partly recovering, which suggests the market currently believes Binance can absorb this. The proof will be a functioning withdrawal page, not a statement.

Sources