Binance said Saturday that it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets in a record crypto theft announced Thursday.
Binance said it will continue to buy the remaining relevant token assets through market and over-the-counter channels until the covered amount reaches 100% for all tokens.
"All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%," Binance said in a statement . "Binance will absorb the financial impact of these stolen funds, not our users."
The exchange said the outstanding 10% consists of tokens outside its top 10 that are "less liquid, which means they may take longer to source in the required amounts."
Binance said it is tapping its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish the assets.
"Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions," Binance said.
Its "next milestone" will be resuming withdrawal services for users by Sunday, subject to security checks, while the exchange continues its investigation into the attack, it said.
Binance did not immediately respond to CNBC for additional details or updates on its investigation.
It still isn't clear how the attack — the largest crypto theft on record — took place.
The world's largest crypto exchange initially said the hack may involve "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." However, Co-CEO Richard Teng later said the attack involved a more complex process rather than the misuse of a single engineer's permissions.
It also wasn't clear who was responsible for the breach. But TRM Labs, a blockchain intelligence and AI investigations company, pointed to North Korean hackers as the potential culprits .
"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst," the company said.
— CNBC's Jenny Lee, Liz Napolitano and Davis Giangiulio contributed to this report.
