Binance said it has allocated more than $6.34 billion in company funds to cover losses caused by the security breach. According to the exchange’s update on Friday, October 30, that amount excludes approximately $3 billion in assets frozen with help from industry partners.
The company estimates the total impact of the October 29 attack at around $6.3 billion. While the funds set aside exceed that estimate, purchases of some of the tokens needed to cover the losses are still underway.
Binance is buying the remaining tokens
According to Binance, approximately $5 billion of the allocated funds is already held in the same tokens affected by the attack. The company is acquiring the remaining roughly $1.3 billion through market purchases and over-the-counter transactions.
Low liquidity in some tokens could slow those purchases. Settlement times for over-the-counter trades could also cause delays.
Setting aside sufficient funds therefore does not mean that Binance has finished acquiring all the necessary tokens. The exchange continues to make purchases to cover users’ holdings in the same assets.
The $3 billion in frozen assets is being treated separately
Following the attack, asset issuers and industry partners moved to freeze funds linked to suspicious transfers. Binance said these efforts resulted in approximately $3 billion in frozen assets.
According to the statements shared, Tether froze more than $1.57 billion in USDT. Circle took similar action involving over $800 million in USDC.
Binance Co-CEO Yi He said Ripple also acted quickly to freeze approximately $200 million in associated funds. World Liberty Financial said it worked with BitGo and other partners to freeze around $27 million in stablecoins and $2 million in its own tokens.
Freezing restricts the movement of those assets, but it does not mean the recovery process is complete. Binance is excluding these funds from its allocated reserves while working with law enforcement and industry partners to trace and recover the assets.
Initial findings pointed to a DevOps engineer’s laptop
Binance Co-CEO Richard Teng said the initial investigation pointed to a compromised laptop belonging to a DevOps engineer. According to Teng, the attacker used that access to reach a service container and submit unauthorized withdrawal transactions.
However, Teng stressed that the attack involved a more complex process than simply using one employee’s permissions. He also said the investigation had not attributed responsibility to any individual.
In a subsequent update, the exchange said investigators had uncovered additional points of breach. The compromised laptop therefore remains an initial finding concerning how the attack may have started; the full technical causes have yet to be established.
Teng also said investigators had so far found no evidence that wallet private keys had been leaked. The company plans to publish a detailed technical report once the investigation is complete and the findings have been verified.
Withdrawals remain on hold
According to Binance’s statements, deposits continue to operate, while withdrawals remain suspended during security work. The company is working on security improvements to its withdrawal service and related addresses.
Assessments of who was behind the attack are also ongoing. Blockchain intelligence firm TRM Labs said the incident shares similarities with attacks linked to North Korea, while Binance has not attributed it to a specific group.
The exchange said it would publicly verify user assets through its Proof of Reserves system. The funds allocated to cover losses, the completion of token purchases and the recovery of frozen assets remain key developments to track as the process continues.
