On Saturday, Binance reported that it has restored 90% of the cryptocurrency taken in Thursday's $6.3 billion hack, up from about 80% in its last update. The exchange still expects to reopen withdrawals on Sunday, Nov. 1.
That 90% includes the coins held by most customers. According to Binance, customer balances in bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed.
The final 10% will take longer
The remaining gap is in less liquid tokens, which Binance said could take more time to buy in the amounts it needs. The exchange is sourcing them on public markets and through over-the-counter deals, and it’s working with industry partners to finish the purchases.
Customers holding those thinner tokens are the ones left waiting. Binance hasn’t given a date for when that last portion will be covered.
On the question of who bears the loss, the exchange was direct. “Binance will absorb the financial impact of these stolen funds, not our users,” its update reads.
How Binance is paying for it
The exchange had already earmarked more than $6.34 billion of company funds, $5 billion of it held in the affected cryptocurrencies. That sum is separate from the roughly $3 billion in stolen assets that partners had frozen.
Money for the replacement assets comes from Binance’s corporate treasury and part of its futures insurance fund. Binance expects to partially deploy its Secure Asset Fund for Users (SAFU) over the next 24 hours.
Under normal conditions, the insurance fund covers losses from bankrupt trading positions. It also helps keep auto-deleveraging in check, the process where other traders’ positions are forcibly cut. Binance said it took only the amount sitting above the fund’s required size, and that the balance left over still satisfies its risk-management requirements. Futures traders will want to keep an eye on that claim.
Binance has also pledged to bring SAFU, its emergency reserve for protecting users, back to about $1 billion.
The hacked wallets backed customer balances
The replenishment closes a hole in the assets that sit behind customer balances. In earlier reserve disclosures, Binance had listed the wallets emptied in the attack among those backing user holdings.
A fresh proof-of-reserves snapshot, taken at midnight UTC on Oct. 31, puts coverage ratios for the named tokens at 100% or higher. That snapshot is a figure Binance reports about itself. The full cryptographic proof, which lets users confirm on their own that their balance appears in Binance’s reported liabilities, is due by Nov. 3, two days after withdrawals are scheduled to resume.
The attacker hasn’t been confirmed
The security investigation is still going. On Friday, co-CEO Richard Teng said investigators had turned up more breach points beyond the employee laptop first suspected of being compromised.
U.S. President Donald Trump commented on the breach, saying “we don’t know” whether North Korea was responsible and that the government is “looking at that.”
Blockchain analytics firms TRM Labs and Chainalysis have both already pinned the attack on TraderTraitor, a hacking group linked to North Korea.