Binance Taps Futures Insurance Fund to Cover $6.3B Hack

Three Reserves Fund the Replacement

Binance has drawn on its futures insurance funds as part of the response to the October 29 breach that carried off about $6.3 billion in digital assets. Its recovery update, published October 31 at 14:24 UTC, names three sources for replacing the stolen tokens: the Secure Asset Fund for Users (SAFU), a portion of the futures insurance funds and corporate treasury. The exchange says only balances held above the required protection level were released, so coverage in the affected pools stays at the minimum its risk framework sets. It has not published how much each source contributed, or the minimum it maintains for any pool touched by the transfer.

Publicly tracked snapshots give traders a partial view of what remains. Aggregated balances across the tracked funds stood near $1.85 billion at 09:00 UTC on November 1, a decline of close to 25% over 24 hours. The shared pool covering BTC, ETH and BNB USDT-margined futures listed 649.67 million USDT and 199.98 million USDC at that reading. An official API snapshot taken at 00:00 UTC on October 17 recorded 791,125,863 USDT and 499,980,384 USDC for the same fund, a combined drop of roughly 441.46 million units, or 34.2%. The two readings span ordinary liquidation activity and possible reallocations, and Binance has not matched the hack-related transfer to a pool-by-pool reconciliation.

Withdrawals are returning in parallel. Binance reopened Bitcoin withdrawals on November 1, scheduling the first window for 06:00–09:00 UTC and restoring selected assets across 15 networks that include Bitcoin, Ethereum and BNB Smart Chain. The exchange reports roughly 95% of the affected assets replenished, with the balance sourced through markets and over-the-counter channels because those tokens are less liquid. The full zero-knowledge proof for the customer reserve snapshot taken at 00:00 UTC on October 31 needs an estimated 40 to 50 hours to generate and is expected by November 3 UTC.

FBI Points to TraderTraitor

The FBI has attributed the theft to TraderTraitor, the label the bureau applies to a North Korean malicious cyber activity it has tracked for years. In a Saturday alert, the FBI states the actors have been converting the stolen funds mostly into Ether (ETH) and expects them to pass through DeFi platforms and instant-swap services as laundering moves into more advanced stages. It urges private-sector participants, including THORNode operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms, to refuse transactions involving the addresses listed in its news release.

Binance began buying replacement tokens almost immediately, with initial holdings of roughly $5 billion in the affected cryptocurrencies, and its pledge to make customers whole did not depend on recovering every stolen token first. Freezing efforts now hinge on the operators named in the FBI alert acting on the listed addresses while the assets remain traceable. The attribution fits a longer pattern. North Korea-linked actors took roughly 60% of the value lost to crypto hacks in 2025, and a CertiK report attributed more than $2 billion of an estimated $3.4 billion in losses that year to groups tied to the regime, across 79 of 656 documented incidents. Cumulative theft by the same actors reached an estimated $6.75 billion across 263 incidents between 2016 and early 2026, which the analysis describes as crypto theft industrialized into a core state revenue mechanism for weapons programs.

ADL Risk and Undisclosed Allocations

Two facts stand out from Binance's own disclosures. The recovery notice quantifies nothing about the insurance-fund contribution: no per-source split, no pool minimum, no change in auto-deleveraging probability, the process that forcibly closes profitable opposing positions when a fund cannot absorb a bankrupt position. Binance's risk documentation weighs fund size alongside order-book depth, volatility, leverage and position concentration, so a smaller balance does not by itself raise the chance that a profitable trade is closed at a bankruptcy price. Even so, the drawdown is real, and traders assessing a contract's cover should read the balance for that specific pool rather than the headline total; the mechanics behind these reserves are laid out in a Binance trading guide. Verification arrives next: the complete proof for the October 31 customer snapshot is due by November 3 UTC, but futures insurance funds sit outside customer proof of reserves, so the per-source allocation stays undisclosed unless Binance publishes it.