Binance says it has set aside more than $6.34 billion of company money after Thursday's hack. But replacing the stolen tokens is still under way, and customers remain unable to withdraw while the exchange repairs its security. [1] [3]
Its Friday update says $5 billion is already held in the same tokens that were affected. Binance is buying the rest through exchanges and private, over-the-counter deals. Thinly traded tokens and settlement delays can slow that work, the company says. [1]
View the figures and calculation
| Measure | Amount |
|---|---|
| Company funds reserved | More than 6.34 |
| Already in affected tokens | 5.00 |
| Approximate amount still being matched | 1.34 |
Rounded reference: 6.34 − 5.00 = 1.34. The actual reserve is reported as more than 6.34. The chart uses a zero baseline and a 0–7 billion scale. The approximately 3 billion frozen separately is excluded, not added to funds available for withdrawal. Amounts reserved, tokens purchased and recovered assets are different measures.
Replacement buying has a specific purpose
The purchases could create demand for the particular tokens Binance needs. They do not establish a lasting price rise: sellers, trading conditions and the size of each market still matter. These purchases replace missing assets rather than demonstrate new customer investment.
Binance separately reports about $3 billion frozen with industry partners. Frozen money still needs recovery and verification; it is not automatically back in customers' hands. The company excludes it from its reserve figure. [1]
“We will weather this storm.”
Company recovery update [1]
A balance on screen is not withdrawal access
Binance's later service notice says deposits are operating normally, while withdrawals remain paused for security changes. Its initial 48-hour reopening estimate is a target, not confirmation that transfers have restarted. [2] [3]
That leaves customers exposed to two separate uncertainties: when their tokens can leave the platform, and what those tokens will be worth then. A promise to replace assets does not protect their market price or provide immediate access.
The investigation has widened
Binance first pointed to a potentially compromised employee laptop, then reported additional entry points. It says it found no evidence of leaked wallet private keys. Its full technical account is still pending. [2]
Blockchain investigator TRM Labs independently traced about $6.36 billion across ten networks, valued when the transfers occurred. It attributes the attack to North Korea's TraderTraitor group with high confidence. That is TRM's assessment, not a published law-enforcement finding about this incident. [4]
Abu Dhabi's Financial Services Regulatory Authority, the financial regulator at ADGM, says it is engaging with Binance and monitoring the unauthorised withdrawals. Its statement does not certify that losses have been repaid. [5]
The next practical test is whether Binance can finish matching the missing tokens and reopen withdrawals safely. Its promised reserves update may provide more evidence, but Friday's allocation alone does not show that customers can move their money again. [1] [2]