Binance is moving to contain the fallout from a record-breaking crypto heist, with CEO Richard Teng saying the exchange has replenished 90% of the assets stolen in a $6.3 billion breach and expects to restore customer withdrawals by Sunday. The disclosure, reported by The Verge and Cointelegraph and echoed across CoinDesk, Yahoo Finance, MSN, the New York Post, Seeking Alpha and Coinfomania, marks one of the most closely watched recovery efforts in the digital-asset industry.

The exchange said the remaining 10% consists of less-liquid tokens that may take longer to acquire. Binance is covering the stolen funds directly, rather than waiting for recovery from the hackers, and has pledged to make customers whole. In a post on X, the company sought to project confidence:

“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident.”

Withdrawals remain paused, but Binance said they are on track to be enabled on Sunday. The exchange did not provide a precise time, leaving customers and market participants to watch for operational updates. For a global exchange of Binance’s scale, restoring withdrawals is the critical test: a pause protects the platform from a run, but a prolonged freeze can erode confidence faster than the original breach.

What Binance says happened

According to the company, hackers stole $6.3 billion in customer assets in what would be the largest crypto heist on record. Binance has since replaced 90% of those assets, with the remainder tied to tokens that are harder to source quickly because of thin liquidity or limited trading depth. The company says it is not passing the loss to users and will absorb the financial impact itself.

The New York Post, citing reports, attributed the attack to North Korean hackers, a framing that adds a geopolitical dimension to what might otherwise be treated as a cybersecurity and liquidity story. Other outlets focused more narrowly on the operational timeline: Cointelegraph emphasized the Sunday withdrawal target, while The Verge stressed that Binance is covering the stolen funds directly and that the final 10% may take longer to acquire.

How outlets frame the recovery

Crypto-native publications tended to focus on the mechanics of replenishment and the withdrawal schedule. Cointelegraph’s headline tied the 90% figure directly to Binance’s Sunday target, while Coinfomania framed the update as a “major recovery” confirmation. CoinDesk and Yahoo Finance, by contrast, emphasized the scale of the breach and the exchange’s effort to let users withdraw funds again, reflecting reader interest in whether customer access will return to normal.

Mainstream and financial outlets highlighted different angles. The New York Post led with the refund angle and the North Korean attribution, while Seeking Alpha treated the news as a market-relevant update for crypto assets such as BTC. MSN’s headlines split between the 90% coverage figure and the broader claim that a majority of stolen funds had been replenished. The variation matters: “refunded,” “replaced,” “replenished” and “covered” are not identical terms, and the distinction between restoring customer balances and recovering stolen tokens is central to understanding the story.

Refund vs. replenishment

Binance’s pledge is essentially a corporate backstop. Customers are promised access to their funds, while the exchange tries to source the missing assets from its own holdings or the market. That is different from law enforcement recovering stolen crypto from the attackers. The remaining 10% is especially sensitive because less-liquid tokens can be difficult to value and even harder to acquire without moving prices. Until Binance provides detailed on-chain proof or a fuller breakdown, the 90% claim remains a company assertion rather than an independently verified accounting.

Why the $6.3 billion figure matters

If confirmed, a $6.3 billion loss would dwarf most previous exchange breaches and rank among the largest crypto thefts ever recorded. The industry has endured Mt. Gox’s 2014 collapse, Coincheck’s 2018 hack and a series of bridge and exchange exploits since, but recoveries of this scale are rare. The size of the Binance case raises questions about custody, internal controls and the concentration of risk in a single platform.

The North Korean attribution, if borne out, would also fit a pattern of state-linked crypto thefts used to fund sanctions evasion. U.S. authorities have repeatedly linked North Korean groups to major exchange and bridge hacks. Binance has not publicly detailed the evidence behind the attribution in the sources reviewed here, so the claim should be treated as reported context rather than a fully established finding.

What to watch next

  • Sunday withdrawals: Whether Binance re-enables withdrawals on schedule and whether users encounter delays, limits or verification checks.
  • Proof of reserves: Whether the exchange publishes granular on-chain evidence showing customer liabilities and asset backing.
  • Valuation of less-liquid tokens: How Binance sources the final 10% and whether those tokens are marked at defensible prices.
  • Regulatory response: Whether authorities in major jurisdictions demand audits, disclosures or changes to custody practices.
  • Customer confidence: Whether deposits return after withdrawals reopen, or whether users move assets to self-custody and rival platforms.

The immediate story is about a company trying to prove it can absorb a historic loss. The larger story is about trust in centralized crypto intermediaries. Binance’s 90% claim is a strong signal, but the final 10%, the Sunday withdrawal test and the lack of full public accounting will determine whether the market treats this as a recovery or merely a pause in a deeper crisis.