Strategy Executive Chairman Michael Saylor has backed Binance’s promise to make customers whole after its $6.3 billion hack, as the exchange has reserved more than $6.34 billion of company funds to replace affected assets.
Summary
- Saylor has endorsed Binance’s reimbursement commitment, saying he expects the exchange to deliver.
- Binance says $5 billion of its reserved funds already matches the cryptocurrencies affected.
- Withdrawals remain paused while the exchange upgrades its systems, with deposits operating normally.
- Investigators have traced stolen assets across 10 blockchains and linked the attack to North Korea.
Michael Saylor, in an Oct. 30 X post, expressed confidence in Binance’s ability to honor its commitment after quoting the exchange’s latest asset-recovery announcement.
“Binance has committed its own balance sheet to making customers whole. I expect it to deliver,” he wrote.
“Our industry will learn from this incident, strengthen security, and emerge stronger and more resilient.”
His statement endorsed the exchange’s response without announcing a financial contribution from Strategy or offering details about its exposure to Binance.
Binance has reserved funds to replace affected tokens
According to Binance’s recovery update, more than $6.34 billion in company funds has been set aside to cover the incident. Of that amount, $5 billion is already held in the exact cryptocurrencies affected by the attack.
The exchange said it was purchasing the remaining tokens through market transactions and over-the-counter channels to match the missing assets and cover shortfalls.
Some purchases could take longer because certain tokens have limited liquidity, while OTC transactions require time to settle, Binance explained.
As crypto.news previously reported, the exchange has begun buying back stolen altcoins. Co-founder Yi He said Binance’s available holdings include Bitcoin and Ethereum, alongside resources in its Secure Asset Fund for Users.
The company has not disclosed how much BTC or ETH it will sell to finance those purchases, nor published individual token purchase amounts or execution prices.
Frozen assets remain separate from replacement funds
Binance said its company allocation excludes frozen or protected assets, which remain subject to recovery and verification. The exchange’s latest stated frozen total stands at approximately $3 billion.
Its announcement describes two processes running alongside each other: purchasing replacement assets with company resources and working with authorities and industry partners to retrieve affected funds.
Binance said it would continue using its own resources to cover confirmed shortfalls and provide further updates as recovery progresses. Customer holdings would ultimately be publicly verified through its proof-of-reserves reporting.
The distinction between frozen and recovered funds remains part of the accounting. Binance has not described the entire frozen balance as money already returned to customers.
Meanwhile, its updated security notice says deposits are operating normally. Withdrawals remain suspended while security checks and changes to the withdrawal service are completed.
An official service update gave an expected resumption window of 48 hours. Binance has promised a detailed technical postmortem after its investigation establishes the facts.
Investigators trace the attack across 10 blockchains
In its preliminary findings, Binance identified a compromised DevOps engineer’s laptop as a possible entry point. The exchange said the attacker may have gained access to an internal service container and submitted unauthorized withdrawal transactions.
Binance said it had found no evidence that wallet private keys leaked and revoked the affected address authorization.
Blockchain intelligence firm TRM Labs separately traced approximately $6.36 billion leaving Binance wallets across 10 networks. Its estimate values each transfer at the asset’s price when it moved.
Most transfers occurred within roughly 20 minutes beginning at 20:05 UTC on Oct. 29, according to the firm. Ethereum accounted for approximately $3.79 billion, followed by Bitcoin at $1.47 billion and Tron at $628 million.
TRM attributed the operation to North Korea’s TraderTraitor group with high confidence, citing on-chain and off-chain intelligence. Binance has not identified the attacker.
Earlier coverage of the North Korea attribution included findings from Blockaid, whose investigators examined the Ethereum authorizations used to seize control of a Binance hot wallet.
The attacker prepared transactions before draining wallets
According to Arkham’s analysis, an operator wallet received Tornado Cash funding on Oct. 28. The attacker tested code on two wallets the following day and rehearsed it on a third.
Arkham tracked a transaction containing 50 authorizations targeting Binance 14. Three minutes and 24 seconds later, a single transfer swept 64 tokens worth $2.53 billion.
Its published snapshot identified 18,270.2 BTC distributed across 19 addresses, with those Bitcoin holdings unmoved since 20:48 UTC on Oct. 29.
