Binance has begun buying back cryptocurrencies stolen in its $6.3 billion security breach, using company reserves and market purchases to replace affected assets in matching token amounts as investigators continue tracing the stolen funds. Summary Binance says it has reserved more than $6.34 billion to cover losses from the October 29 security breach. The exchange already holds $5 billion in the affected tokens and is buying the remaining assets through exchanges and OTC desks. Co-founder Yi He says Binance is using its SAFU fund and company holdings, including BTC and ETH, to replace stolen altcoins. Chainalysis has linked the attack to North Korea’s TraderTraitor group and identified unusual automated laundering activity. Binance’s Thai partner Gulf has offered liquidity assistance, although CZ says the exchange can cover its losses independently. As per of an October 30 company update, the exchange has reserved more than $6.34 billion to cover the incident, including $5 billion already held in the same cryptocurrencies that attackers transferred from its wallets. Binance is purchasing the remaining tokens through cryptocurrency exchanges and over-the-counter (OTC) trading desks. The company said some purchases could take longer because certain assets have limited liquidity, while privately negotiated OTC transactions require settlement. Binance buys stolen altcoins using company reserves Binance co-founder Yi He confirmed that the exchange was using its Secure Asset Fund for Users (SAFU) and existing cryptocurrency holdings to rebuild the affected balances. “Binance’s SAFU fund and Binance’s holdings include a large amount of assets such as BTC and ETH,” she wrote. The company intends to purchase the stolen altcoins in fully matching quantities, with another update planned after the transactions finish. Although Yi He identified BTC and ETH among available reserves, Binance has not disclosed how much of either cryptocurrency it will sell to fund the purchases. Binance’s SAFU fund and Binance’s holdings include a large amount of assets such as BTC and ETH. We are currently buying, through OTC and on-exchange, all the stolen altcoins in fully matching amounts. We will update everyone again once the purchases are complete.… https://t.co/TTUV5nS0ec— Yi He (@heyibinance) October 30, 2026 The distinction matters for the reported recovery figures. The $6.34 billion represents funds Binance says it has reserved, while the $5 billion represents affected token assets already available within those reserves. Neither figure establishes the amount of new buying that must occur on the open market. Binance said its purchase calculations exclude frozen or protected assets, which remain subject to recovery checks. The company reported $3 billion frozen through cooperation with token issuers, investigators and law enforcement. UNI, PEPE and LINK among stolen assets sold by hacker The repurchases follow large sales of stolen altcoins by the attacker, who exchanged several cryptocurrencies for Ethereum shortly after the breach. As reported earlier today, on-chain tracker Lookonchain identified the sale of 7.02 million UNI worth $39.63 million. The attacker reportedly sold 7.77 trillion PEPE for $31.66 million, alongside 217.5 million ENA worth $33.93 million and 2.57 million LINK valued at $26.05 million. AAVE, ONDO and WLD were among the other affected tokens. The seven reported sales generated 70,480 ETH worth $158.25 million at the time. The PEPE sell-off coincided with heavy volatility, although a well-known holder subsequently purchased another 45.08 billion tokens worth $206,500. Binance’s decision to replace stolen assets in their original denominations could create demand for individual tokens. However, OTC transactions may match buyers with sellers without placing equivalent orders on public exchanges. The company has not published individual repurchase amounts, execution prices or a breakdown of purchases completed. Chainalysis identifies unusual laundering activity While Binance works to restore customer balances, blockchain investigators continue tracking cryptocurrency that escaped the initial freezing efforts. In an October 30 investigation, Chainalysis attributed the attack to TraderTraitor, a North Korean cybercrime group previously associated with major cryptocurrency thefts. The firm identified a direct connection between funds stolen from Binance and assets taken during September’s Bitget exploit. Investigators said the two groups of funds entered shared wallets, strengthening their assessment of North Korean involvement. According to the report, attackers initially moved $500 million in stablecoins into a wallet intended to exchange assets that issuers could freeze. Over nearly 20 minutes, they converted $325 million in stablecoins into $285 million in ETH. The remaining $175 million was subsequently transferred to intermediary wallets. Investigators have since observed thousands of transactions involving repeated transfers between addresses. Some wallets receive exactly 1 TRX before processing additional funds, a pattern the firm believes suggests automated laundering. Gulf offers Binance liquidity support after hack Binance founder Changpeng Zhao (CZ) said the exchange’s Thai partner, Gulf, had offered financial assistance during the crisis. In his statement, Zhao recalled a similar offer following Binance’s $4 billion settlement with U.S. authorities in 2023. “Know you can cover, but we are here if needed,” he quoted the latest message as saying. Binance TH separately said its customer assets remained safe because the Thai business maintains independent custody arrangements and segregated cold wallets. In 2023, after news of the $4 billion fine, Gulf, our partner in Thailand, asked: “do you need help with cash liquidity?” We didn’t, but I appreciated the gesture.Today: “know you can cover, but we are here if needed.”Strong partners show in tough times. 🙏 https://t.co/0GzOIMBwyK— CZ 🔶 BNB (@cz_binance) October 30, 2026 The local exchange temporarily suspended deposits and withdrawals for security checks, while other services continued operating. Binance said it would publish additional recovery updates as purchases progress and eventually verify customer holdings through its Proof of Reserves reporting.
