Ten tokens, fully restored. That was the line Binance drew on Saturday, two days after it disclosed the largest theft in the history of crypto. Bitcoin, Ether, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash are, the exchange says, backed one-for-one again. The rest of the roughly $6.3 billion pulled from its hot wallets is a different matter. About 90% of the total is now covered, and the last tenth is still being bought on the open market.
Binance was careful to spell out what that figure means, and it is worth repeating. As CNBC reported, the 90% describes how much of the missing customer backing has been replaced from the exchange's own resources. It does not mean the money has been clawed back from whoever took it. None of the stolen funds, as far as anyone has said publicly, has come home.
What Binance has actually restored
The replenishment has come from three places, according to the company's statement. The first is its Secure Asset Fund for Users, known as SAFU, the emergency reserve Binance has long held up as proof it can absorb a disaster. The second is a portion of the insurance fund that backs its futures business. The third is plain corporate treasury. Binance has not said how much came from each pot. That omission will draw attention in the days ahead, because the answer determines how much cushion the exchange has left if another incident follows.
The company's promise was blunt: "Binance will absorb the financial impact of these stolen funds, not our users." It added that the purchases of the remaining tokens will continue, on public order books and in privately negotiated trades, until every asset is covered in full.
The unfinished tenth is made up of tokens outside the top ten by liquidity. Those are harder to buy in size without moving the price against yourself, which is why they lag. That is a reasonable explanation, and it also points to the most exposed part of the recovery: a buyer with a very large order and a very public deadline. Thinly traded tokens get expensive fast when everyone knows there's a whale shopping.
The next milestone is reopening withdrawals. Binance says it still intends to do so on Sunday, subject to security checks and a final go-ahead, and that caveat carries weight. A reopening reversed an hour later would do more damage than a delay of a day.
A cause nobody can yet state
How the attacker got in remains unsettled. Binance's first public account pointed to a compromised laptop belonging to a DevOps engineer, which would have given the intruder a foothold in a service container and the ability to submit withdrawal transactions nobody had approved. Co-CEO Richard Teng has since said the operation was more elaborate than the abuse of one engineer's access. In a later post, Binance said its investigation had turned up additional points of breach, without naming them.
So the public record is a laptop story that has been partly walked back, plus a promise of more detail. That is an uncomfortable place to stand when you are asking customers to trust that the hole is plugged. If the entry point is not fully understood, the claim that it is closed has to rest on something else.
Nor has anyone been formally identified as responsible. TRM Labs, the blockchain intelligence firm, has pointed toward North Korean operators. Its reasoning is circumstantial but specific: modest Tornado Cash withdrawals that funded an operator wallet, groundwork laid long before the money moved, and signatures collected ahead of time and then deployed all at once. The company said those traits echo the Bybit heist and the KelpDAO attack in April 2026. Attribution in this field is rarely settled quickly, and a pattern match is not a confession. Still, the Bybit comparison is hard to wave off, since that theft also hinged on patient staging and a fast, coordinated finish.
Should anyone leave money on an exchange?
Once the immediate scramble eases, the second question is the older one: whether keeping funds on an exchange is sensible at all. Experts who spoke to CNBC for a separate piece on wallet safety did not agree.
Tyler Moore, who teaches cybersecurity at the University of Tulsa and has watched the crypto industry for more than ten years, called the practice "extremely dangerous" for significant sums. His argument is structural. Americans who keep money in a bank are covered by federal deposit insurance, though only to a ceiling of $250,000 for each depositor at each insured institution. Nobody offers an equivalent for money lost from a crypto exchange, and Moore expects more breaches of this kind, so a customer's protection depends on the goodwill and balance sheet of the platform.
Ido Ben-Natan, chief executive of the security firm Blockaid, reads the same facts the other way. Binance and Polymarket both said they would make users whole, and he expects nobody to lose money. He went further, suggesting that an exchange wallet could end up safer than other options once the industry has absorbed enough experience of how to respond. Brett Falk, who runs the University of Pennsylvania's Crypto and Society Lab, offered a similar view that individuals probably won't take losses.
Both camps may be right, which is the awkward part. Customers of Binance look likely to be made whole this time, and that outcome depends entirely on a company that happened to have a very large reserve. A smaller exchange hit by a similar attack would not have a SAFU, a futures insurance fund and a treasury to drain. The assurance is real, but it isn't transferable.
There was a second incident the same day. Polymarket briefly suspended trading on its international platform after a compromise at an outside data vendor, and at least $2.7 million left users' wallets. The platform runs on the Polygon blockchain. Experts told CNBC that more incidents are probable in the near term, especially as artificial intelligence tools get better at finding weaknesses in existing defenses.
The regulatory argument, and its limits
The breach hit Binance's offshore platform. Its regulated U.S. exchange did not suffer the same problem, and Polymarket's domestic exchange was likewise untouched. Coinbase and Robinhood were not affected either, though shares in both fell on Friday as the news spread.
That gap gave Washington an opening. Michael Selig, who chairs the Commodity Futures Trading Commission, told CNBC that offshore venues "don't have the same sorts of safeguards that we have in our financial markets." He said the agency wants to give such exchanges a federal route to register with the CFTC and accept the same cybersecurity expectations that apply onshore.
Falk was skeptical that rules would have changed the outcome. If the breach did begin with a compromised engineer's machine, he noted, most regulation doesn't reach the specific software used to authenticate staff. A compliance regime can demand audits, reporting and capital. It is much less able to dictate how a company configures the tools its engineers log into every morning. That is a fair point against anyone treating registration as a cure, and it cuts against the neat story that onshore means safe. The U.S. exchanges escaped this time, but nobody has shown that regulation was the reason.
What comes after Sunday
The immediate test is simple: withdrawals either reopen on schedule and hold, or they don't. Customers who have been locked out for days will judge Binance on that far more than on any statement about reserves.
After that come the harder disclosures. Binance has yet to explain the full chain of events, to say how much of each reserve it spent, or to show that the additional breach points it mentioned are closed. It also has to finish buying the illiquid tokens without paying a punishing premium (the whale, again), and it has to do so while the thieves, if TRM is right about who they are, move the stolen assets through the same mixing and laundering routes used after earlier heists.
The exchange has promised measurable progress and transparent reporting. Those commitments can be checked, and over the next few weeks they will be.