---
title: "Binance has fully reimbursed clients for $6.34 billion stolen by hackers — the largest crypto incident in history is closed"
description: "Binance has completed the reimbursement of all assets stolen by hackers in the largest crypto incident in history, using over $6.34 billion of its own funds and updating its reserve verification system to 198 tokens."
date: 2026-11-12T22:13:21.235Z
lang: en
url: https://xab.info/en/posts/binance-reimbursed-stolen-assets-6-34-billion
tags: [binance, crypto-hack, proof-of-reserves, safu, cybersecurity]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Binance has fully reimbursed clients for $6.34 billion stolen by hackers — the largest crypto incident in history is closed

![Graphic representation of a padlock against a dark staircase, symbolizing cybersecurity.](https://xab.info/media/2026/11/12/binance-vozmetila-ukradennye-aktivy-6-34-mlrd/binance-vozmetila-ukradennye-aktivy-6-34-mlrd-1.webp)

## Key Points

- Binance has fully reimbursed clients for stolen assets totaling over $6.34 billion — the largest crypto incident in history.
- Compensation was provided via SAFU, the Futures Insurance Fund, and corporate treasury; rare tokens were bought on the market and via OTC deals.
- The Proof of Reserves system has been updated to cover 198 tokens, allowing users to verify reserves.
- Hackers gained access through a fake job interview and an internal AI tool; the attack is linked to a group connected to organizations in North Korea.

Cryptocurrency exchange Binance has announced the completion of reimbursements to clients for all digital assets stolen in the largest incident of its kind in history. The company allocated over $6.34 billion of its own funds to cover the damages. The reimbursement took slightly longer than originally expected: the exchange had to purchase rare and low-liquidity tokens on the market to restore collateral in the specific cryptocurrencies affected by the attack, rather than merely providing their cash equivalent.

### Three sources of compensation funding

According to the exchange, the damage coverage was provided by three sources: a portion of the reserve "Secure Asset Fund for Users" (SAFU), funds from the Futures Insurance Fund, and the corporate treasury. The missing tokens were purchased on the open market and through over-the-counter (OTC) deals. This approach allowed for the restoration of collateral in the specific cryptocurrencies affected by the attack. Binance also promised to replenish the SAFU to approximately $1 billion to maintain it as a separate reserve for user protection.

### Updated reserve verification system

Simultaneously with the completion of the compensation, the exchange updated its Proof of Reserves (PoR) system. It now covers 198 tokens and allows users to independently verify the existence of reserves that match the exchange's obligations to clients. The company emphasizes that while this expands public access to reserve data, it is not an independent audit of all the company's financial liabilities.

### How the hackers operated

According to Binance's internal investigation, the attackers used a fake job interview to compromise an employee's computer and an internal artificial intelligence-based tool. This gave them control over hot wallets and the ability to withdraw funds totaling $6.34 billion. The attack is linked to a hacker group reported to have connections with organizations in North Korea.

### Reimbursement timeline

The attack occurred on October 29. By November 1, Binance had reimbursed 95% of the stolen tokens and began disbursing funds to clients. It took another ten days to find and purchase rare and low-liquidity assets. The exchange stated that the costs of purchasing the tokens would not be passed on to the clients. Thus, as of November 12, the largest crypto incident in history is formally closed: all stolen assets have been returned to users, and the reserve verification system has been expanded to 198 tokens.

## Fact-Check & Sources

- [Binance полностью возместила клиентам украденные хакерами активы на $6,3 млрд](https://3dnews.ru/1151237) - Primary source: Official Binance statements on the completion of the $6.34 billion reimbursement, funding sources (SAFU, Futures Insurance Fund, treasury), PoR update to 198 tokens, and the attack method involving a fake interview and AI tool. Connection to North Korea is mentioned with a disclaimer.
- [Binance полностью возместила клиентам украденные хакерами активы на $6,3 млрд](https://3dnews.ru/1151237/binance-polnostyu-vozmestila-klientam-ukradennie-hakerami-aktivi-na-63-mlrd) - Duplicate link to the same 3dnews material (1151237); factual content aligns with the primary source.

## FAQ

### How much did Binance spend on compensation?

Over $6.34 billion of its own funds, including a portion of the SAFU reserve, the Futures Insurance Fund, and the corporate treasury.

### Why did the reimbursement take longer?

The exchange had to acquire rare and low-liquidity tokens on the open market and through OTC deals to restore collateral in the exact cryptocurrencies that were stolen.

### How did hackers gain access to the funds?

According to Binance's investigation, they used a fake job interview to compromise a computer and an internal AI tool, granting control over hot wallets.

### What is the updated Proof of Reserves system?

A mechanism covering 198 tokens that allows users to verify reserves against exchange obligations; it is not an independent audit of all financial liabilities.