By Sophie Lindqvist

Binance says it has made customers whole for all $6.3 billion taken in what Bloomberg describes as the biggest digital heist ever recorded. The exchange announced the milestone in a social-media post on Thursday, according to Bloomberg.

Binance wrote: “To our users and community: thank you for your patience and understanding.” In an Oct. 31 update, it put the financial commitment more plainly: “Binance will absorb the financial impact of these stolen funds, not our users.”

The reimbursement replaces missing crypto with assets Binance supplied through reserves and insurance funds; it does not mean attackers returned the stolen tokens. Bloomberg supplies the record-size description, while the cited material presents Binance’s account without an independent audit of the payout or a complete asset breakdown.

How did Binance cover the full loss?

On Oct. 31, Binance said it had raised coverage to 90%. At that point, BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed, meaning available reserves matched customer claims for those ten assets.

The remaining 10% consisted of tokens outside those ten. Binance called them less liquid, meaning harder to trade in large amounts, and said sourcing them in the required quantities could take longer. It did not name those tokens or quantify their sourcing costs.

Binance bought the remaining tokens through market purchases and over-the-counter (OTC) trades, which occur directly between counterparties rather than on a public order book. It said a partial deployment of the Secure Asset Fund for Users (SAFU), its emergency reserve for user assets, helped finance the replacement.

The funding combined a partial deployment of the Secure Asset Fund for Users (SAFU) with part of the Futures insurance fund and the corporate treasury. Binance described SAFU as an emergency reserve for user assets and said it would restore the fund to about $1 billion.

What did the attackers target first?

Binance said last week that hackers it attributes to North Korea used fake job interviews and malicious software in a campaign that began in June. In June, a staffer who builds Binance wallets installed a doctored AI tool. In September, someone posing as a project director approached a second software engineer through a job-hunting platform.

On Oct. 29, the attackers logged in with stolen credentials, set up a container, meaning an isolated software environment, and ran a malicious script that started the theft from the wallet.

The sequence Binance described links deceptive recruitment contacts to malicious software, then stolen credentials to code execution. The source does not explain how the credentials reached the attackers, what vetting the AI tool received, or whether either engineer knowingly assisted them. Those omissions limit any conclusion about how the control failure occurred.

How did Binance respond?

After the Oct. 29 theft, Binance said it froze or intercepted about $2.85 billion in assets and closed the entry points the attackers used. It paused withdrawals after the incident and began letting users withdraw again on Nov. 1.

Freezing or intercepting assets protected balances; it did not itself reimburse users. Resuming withdrawals on Nov. 1 restored access while the final reimbursement work continued, although the source gives no completion date until the later Thursday announcement.

What does full reimbursement change for customers?

For Binance customers, the direct loss now sits with the exchange, which says it replaced the full $6.3 billion value stolen. The practical result is restored balances and resumed withdrawals, not recovery of the original tokens from the attackers.

For Binance, the cost is concrete: the exchange must replenish SAFU to about $1 billion while absorbing the financial impact. The cited material does not quantify that wider cost beyond the $6.3 billion theft and the stated fund replenishment.

The FBI has attributed the breach to North Korean hackers, and North Korea has denied the claim. That leaves the attribution politically disputed, although the reimbursement decision does not depend on resolving it.

The unresolved questions concern control and verification: how stolen credentials reached the attackers, how the doctored AI tool entered a wallet engineer’s environment, and whether an independent review can verify both the payout and the $6.3 billion valuation. The source supplies no answers to those questions.

Binance has removed the reimbursement shortfall. It has not demonstrated that similar recruitment-based intrusions are now contained.