Statements

At least $5.57 billion in crypto has left wallets linked to Binance across three blockchains in what appears to be a breach of the world’s largest cryptocurrency exchange.

Blockchain analytics firms Chainalysis and TRM Labs put the total at around $6.4 billion, more than four times the previous record, February 2025’s $1.5 billion Bybit heist.

The Futures Insurance Funds remain above the coverage level required under Binance’s established risk-management framework, helping ensure the fund remains available to support users during extreme market conditions. We monitor fund size continuously against historical stress scenarios reflecting extreme but plausible market conditions, and top it up when required. Due to volatility, no exchange can completely avoid auto-deleveraging, but we always strive to keep occurrences to a minimum. Will Binance replenish the Futures Insurance Funds? The funds are maintained above their required size. When the balance falls below the level our framework requires, Binance tops them up from company funds, as we have done previously. What was released was excess above that level, which is why it could be reallocated without affecting coverage.

Binance is committing to replenishing the SAFU to return the fund size to approximately US$1 billion.

We remain on track to reopen withdrawals within our previously stated timeframe (on Sunday, 2026-11-01) and will provide a further update as soon as details are confirmed.

All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%.

Our last update explained that Binance had set aside more than $6.34B in company funds to cover hacked losses, and we had already covered approximately 80% of the impacted amount of the hacked loss at that time. That covered amount is now up to 90%.

SAFU is an emergency reserve fund established by Binance in July 2018 to protect user assets in extreme cases, such as security breaches or platform-level incidents. Binance allocated a percentage of trading fees to grow the fund to a substantial level over time. The SAFU fund is held and managed by Nest Clearing and Custody Limited, a Recognized Clearing House regulated by the Abu Dhabi Global Market (ADGM) Financial Services Regulatory Authority. A portion of the funds serves as capital reserves as part of Binance regulatory obligations in the ADGM.

The outstanding 10% consists of tokens outside the top ten listed above.

The full zero-knowledge proof takes approximately 40 to 50 hours to generate due to the computational workload, so users holding any of these ten tokens can independently verify that their assets are at a minimum 1:1 backed once the full proof is generated, estimated to be by Tuesday, 2026-11-03 (UTC).

we have taken a new Proof of Reserve (PoR) snapshot at 2026-10-31 00:00 (UTC), and this has already been updated on the PoR website.

The replenishment employed: - A partial deployment of the Secure Asset Fund for Users (SAFU). This is expected to happen over the next 24 hours; users can view the updated balance here. - A portion of our Futures insurance fund. The remaining balance of the Futures insurance fund is a regulatory requirement. Users can check the updated balance of the fund here. - Binance's own corporate treasury.

The sweeper contract was only around 130 lines, Immunefi Vice President Simone Imbrescia said in a statement shared with The Block. "The hard part sometimes is getting access to a system powerful enough to make very simple code devastating," Imbrescia said.

The firm has also been tracking funds stolen in Binance’s separate multibillion-dollar hack, saying the attackers are using automation to obscure the trail and leveraging DeFi protocols on Tron to dodge stablecoin freezes.

Chainalysis said the incident is "not related to the recent crypto theft at Binance."

Blockchain analytics firm Chainalysis said an AI-assisted hacker breached its systems and accessed “non-sensitive” customer data, including names and emails.

Soon after the $6.3 billion hack of Binance, the biggest in crypto history, some political and administration figures began offering their opinions with a US election approaching on Nov. 3 and voting already having begun in many locations.

It was not clear whether there was any immediate political advantage to be gained from the hack, which was widely attributed to a North Korean group, but Republican and Democratic sides began staking out positions almost immediately.

Yet, picking politically attractive proxy-scapegoats is a classic pro move.

I think NK is a convenient target to blame, instead of highlighting that random events from random insiders across different financial operations are the actual cause.

We are utilizing part of the SAFU fund to acquire the remaining 10% of outstanding assets in order to reach 100% coverage for all tokens.

All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%. We will continue to buy the remaining relevant token assets through market and OTC channels until the covered amount reaches 100% for all tokens.

Most of it is swapped through THORChain. About $31 million has gone into THORChain in total, at a rate of roughly 100 swaps every two hours since midnight.

The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

On October 31, the FBI attributed the theft to TraderTraitor, its name for a North Korean state-sponsored hacking group. This confirms Elliptic's earlier assessment.