CZ Says Binance Covered $6.3B Hack Without Loans or Asset Sales

Binance did not borrow, sell assets or raise money to cover the roughly $6.3 billion stolen on October 29, CZ said in a post on X on November 2. "Binance covered from its balance sheet," he wrote, according to the wording quoted from the post.

For anyone with coins on the exchange, the practical claim is that the hole has been filled with Binance's own money, not yours. Chief executive Richard Teng said customer funds were not used. "We are committed to covering all hacked losses through our company funds. Your assets are safe," he said.

That is a statement from the exchange's own leadership, not an audited account. It is also the most direct answer yet to the question holders have asked since the theft: who pays?

Where the $6.3 Billion Came From

Binance used a mix of its Secure Asset Fund for Users (SAFU), part of its Futures insurance fund and its corporate treasury to cover the losses. The SAFU draw-down is covered in our report on the SAFU fund halving to 7,500 BTC.

Teng said Binance reserved more than $6.34 billion of company funds. About $5 billion of that was already held in the exact tokens taken, including USDC, USDT, BTC, ETH and BNB. The exchange is buying the rest through market and over-the-counter channels.

Teng said the capacity to absorb a loss this size comes from keeping much of Binance's operating earnings in crypto. Buying the missing tokens means spending something, and the statements do not spell out which pool paid for those purchases. That detail is what would turn the "no asset sales" line from a claim into a checkable figure.

CZ framed the outcome against past collapses. Unlike Mt. Gox and FTX, where nearly all users were affected, Binance is covering the losses itself, he said. "It hurts, but we survive."

The contrast with Bybit is sharper. Bybit said it closed its 2025 ETH shortfall partly with bridge loans. CZ says Binance avoided borrowing altogether.

How Far the Refill Has Gone

The replenishment numbers come in two versions:

• By October 31, Binance reported roughly 90% of impacted funds replenished, with BTC, ETH, USDT, BNB, SOL, USDC and XRP at 100% backing.
• Binance's November 2 update put the figure at about 95%, with purchases of smaller, less-liquid tokens still under way.

The two figures may simply reflect different dates. CZ said on November 2 that only minor conversions of those smaller tokens remain.

Withdrawals Topped $10.97 Billion in Two Days

Binance's own flow figures show $10.97 billion in withdrawals and $5.695 billion in deposits between 06:00 UTC on November 1 and 04:00 UTC on November 3. Net outflows came to about $5.276 billion, or 3.1% of the $171 billion in assets Binance had previously reported.

The heaviest hour began at 08:00 UTC on November 1, when withdrawals reached $1.243 billion. By November 3, Binance said hourly deposits had begun to exceed withdrawals. Withdrawals are resuming in phases across nine networks.

CZ cited public reports that only 6% to 10% of withdrawals went to rival centralized exchanges, with most moving to self-custody wallets. If that holds, the money leaving is mostly users taking custody, not switching venues. The reports themselves were not named.

The Hack Itself

Attackers drained funds across roughly ten networks in under 30 minutes. Binance's initial investigation traced the breach to a compromised DevOps engineer's laptop, and the exchange said no private keys leaked. Teng said the attack hit Binance's own hot wallet, and the attacker used an EIP-7702 delegation that bypassed normal approval controls.

Blockchain analytics firms Chainalysis and TRM Labs attributed the theft to North Korean hackers, named as the Lazarus Group in some reporting and as TraderTraitor in others. The FBI attributed it to TraderTraitor. North Korea denied responsibility on November 3, when Kim Yo Jong called the US accusations "absurd rhetoric".

Stablecoin issuers stepped in too. Tether froze about $1.57 billion in USDT, Circle blocked over $800 million in USDC and Ripple froze $200 million in RLUSD. Our earlier piece on how much of the stolen money is frozen tracks that side of the story.

The next number to watch is the last 5%: the less-liquid tokens Binance is still buying, and whether hourly deposits keep running ahead of withdrawals as all nine networks reopen.