The co-CEO says 95% of affected tokens have been replenished and that hourly flows have largely normalized following the October 29 breach
Binance co-CEO Richard Teng has a message for anyone wondering whether the world’s largest crypto exchange is still standing: it is. Speaking at Hong Kong Fintech Week on November 3, Teng said the exchange had replenished 95% of the tokens affected by a $6.3 billion cyber heist.
Teng also said hourly inflows and outflows at the exchange had “pretty much normalised.” He indicated that more information about the breach will be released in due course.
How the breach unfolded
The attack hit on October 29, 2026. Attackers drained approximately $6.3 billion from Binance’s hot wallets in about 30 minutes.
Hot wallets are the internet-connected accounts exchanges use to process daily withdrawals. They are convenient, and that convenience makes them a target.
The unauthorized withdrawals spread across numerous blockchains, chiefly Ethereum and Bitcoin.
Binance paused withdrawals soon after the breach. They resumed on November 1, and the exchange recorded net outflows of $4.72 billion by that date.
Who paid the bill
Teng said the losses were covered by the Secure Asset Fund for Users, better known as SAFU, along with other company funds that had been set aside. The research findings list three sources in total: SAFU, the Futures Insurance Fund, and corporate treasury reserves.
SAFU is Binance’s emergency reserve, built specifically for scenarios like this one. It has historically been valued at around $1 billion.
Binance has said customer assets were unaffected and that the exchange would absorb all losses tied to the breach.
Approximately $3 billion in stablecoins was frozen through cooperation with issuers and law enforcement agencies.
The North Korea connection
The attack has been attributed with high confidence to TraderTraitor, a group linked to North Korea. The same group was also implicated in the 2025 Bybit hack. FBI involvement in the investigation has been reported.
Initial findings point to a compromised laptop belonging to a DevOps engineer as the entry point. That access opened the door to the unauthorized transactions.
Binance has said its key management systems were not compromised. The distinction is important: a breached laptop is a serious lapse, while compromised private keys would suggest a deeper failure in how the exchange secures its most sensitive credentials.
What this means for exchanges and users
For Binance, the immediate story is survival with a balance sheet intact. Replenishing 95% of affected tokens within days, while honoring withdrawals, is a stress test most firms would never want to run in public. Teng’s appearance in Hong Kong was a confidence play, and the normalized flow data is the evidence he is leaning on.
The $4.72 billion in net outflows tells a more cautious story. Users clearly wanted proof before trust, and some may not return quickly.
The roughly $3 billion in frozen stablecoins also highlights how much recovery now depends on issuers and law enforcement working together.
Key items to track from here include the fuller account of the breach that Teng said is coming, the pace at which Binance rebuilds SAFU, and whether investigators recover more of the funds that remain outstanding. The remaining 5% of affected tokens is small in percentage terms, but at this scale even small percentages carry real weight.
