The exchange said it has set aside more than $6.34 billion to repay users in kind and is buying the rest on the market. It aims to reopen withdrawals by Sunday, and its chief executive said the attacker exploited an Ethereum feature that bypassed normal approval controls.
A day after disclosing a breach it estimated at about $6.3 billion, Binance moved the question from whether it can cover the losses to whether it can prove it.
"Binance has already reserved over $6.34B of company funds to cover this incident," the exchange said Friday. "$5B of these funds are already held in the exact token assets that were impacted." It said it is buying the remaining amount, roughly $1.34 billion, through exchanges and over-the-counter desks so users can be repaid in the same tokens, a process that may take longer for less liquid coins.
The figures exclude the roughly $3 billion that Binance says has been frozen on-chain with the help of token issuers and other partners. "We will weather this storm," the exchange said, adding that user funds will be verified publicly through its proof of reserves.
How the attacker got in
Binance has said a compromised laptop belonging to one of its DevOps engineers gave the attacker access to a service container, which was used to submit unauthorized withdrawals, and that it found no evidence of a wallet private-key leak. Chief Executive Richard Teng added detail on Friday: the attacker used an EIP-7702 delegation, a feature added to Ethereum in 2025, that bypassed the exchange's normal approval controls. He said only Binance's own hot wallet was hit, not customer funds.
Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean hacking group. Chainalysis said stolen funds were mixed with proceeds from last month's exploit at the exchange Bitget.
The timetable
Binance aims to restore withdrawals by Sunday and publish a full proof of reserves by Monday, Teng said. Deposits have continued to operate normally.
Before the $5 billion disclosure, security firm CertiK estimated that frozen assets and Binance's SAFU insurance fund covered about two-thirds of the loss, leaving a potential gap of about $2.1 billion. CertiK said it needs more information to verify the $5 billion holding on-chain. Binance has not disclosed the wallet addresses or when the tokens were acquired.
BNB, the token most closely tied to the exchange, was little changed at about $701.
Contained or unverified?
The contained reading: Binance says its reserve exceeds the estimated loss, the frozen $3 billion is potential upside, and it has a date for both reopening and proof.
The unverified reading: the $5 billion sits in wallets no one outside Binance can yet see, independent analysts have not confirmed it, and the reopening will be the first real test of whether customers keep their money on the platform.
The incident also raises a question for every exchange. If a 2025 Ethereum feature can bypass approval controls at the largest one, rivals' hot wallets may share the same exposure.
What to watch
The withdrawal restart, targeted for Sunday; net flows off Binance once it reopens; Monday's proof of reserves; and whether the frozen $3 billion is returned.