Binance has replaced approximately 90% of the cryptocurrency stolen during a record-breaking $6.3 billion cyberattack, using its own financial reserves to purchase replacement tokens and restore customer assets.

The cryptocurrency exchange announced the recovery progress Saturday, October 31, after revealing that hackers had stolen approximately $6.3 billion worth of digital assets from its platform. The company said it had increased the amount of recovered and replaced assets from approximately 80% to 90% and was continuing efforts to cover the remaining losses.

“We've now replenished 90 per cent of the stolen assets, and we're committed to covering the remaining 10 per cent. Our users will not bear the financial impact of this incident,” Binance co-CEO Richard Teng said.

Binance said it had allocated more than $6.34 billion in company funds to address the breach, using a combination of its corporate treasury, its Secure Asset Fund for Users (SAFU) and its Futures Insurance Fund. The exchange emphasized that the financial burden would fall on the company rather than customers whose accounts were affected.

The company confirmed that holdings of 10 major cryptocurrencies, including Bitcoin, Ethereum, Tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD and Zcash, were now fully backed at a minimum one-to-one ratio.

The remaining 10% of the stolen assets consists primarily of less-liquid cryptocurrencies that are more difficult to acquire in large quantities. Binance said it was purchasing replacement tokens through public markets and over-the-counter transactions while working with industry partners to complete the process.

The company also said it would replenish its SAFU emergency reserve to approximately $1 billion after using a portion of the fund to help cover the losses. The reserve was established to protect customers during extraordinary circumstances, including security breaches.

The attack, which occurred Thursday, October 29, involved approximately $6.3 billion in cryptocurrency moving out of Binance wallets across 10 different blockchains. Blockchain security researchers reported that most of the stolen assets were transferred within approximately 20 minutes, making it one of the largest cryptocurrency thefts ever recorded.

The FBI announced Saturday that a North Korean state-sponsored hacking group known as TraderTraitor was responsible for the attack. Investigators said members of the group were observed converting stolen assets into Ethereum and warned that additional laundering attempts were expected.

The FBI's attribution adds to longstanding concerns about North Korea's use of cybercrime to generate revenue for its government. North Korean hacking groups have been linked to numerous cryptocurrency thefts in recent years, with stolen digital assets frequently moved through complicated networks to conceal their origins.

Binance described the breach as a sophisticated attack involving a compromised laptop and malicious software designed to erase evidence of its activity. Co-CEO Richard Teng said investigators had identified additional potential points of compromise as the company worked to determine exactly how the attackers gained access.

Following the discovery of the theft, Binance temporarily suspended customer withdrawals while it investigated the incident and worked to secure its systems. The exchange said Saturday that it remained on schedule to resume withdrawals on Sunday, November 1.

Binance also published an updated proof-of-reserves snapshot showing that the 10 major cryptocurrencies identified in its announcement were fully backed. The company said a complete cryptographic verification process was expected to become available by November 3, allowing eligible customers to independently verify that their holdings were backed.

The recovery effort represents a major financial commitment by Binance as it attempts to restore customer confidence following the unprecedented breach. Although the exchange has replaced most of the stolen assets, the remaining lower-liquidity tokens still need to be acquired before the company can declare the recovery complete.