{"id":24876,"date":"2026-10-30T12:36:40","date_gmt":"2026-10-30T12:36:40","guid":{"rendered":"https:\/\/cryptoted.net\/index.php\/2026\/10\/30\/binance-begins-buying-back-stolen-altcoins-using-bitcoin-ethereum-after-6-3b-hack\/"},"modified":"2026-10-30T12:36:40","modified_gmt":"2026-10-30T12:36:40","slug":"binance-begins-buying-back-stolen-altcoins-using-bitcoin-ethereum-after-6-3b-hack","status":"publish","type":"post","link":"https:\/\/cryptoted.net\/index.php\/2026\/10\/30\/binance-begins-buying-back-stolen-altcoins-using-bitcoin-ethereum-after-6-3b-hack\/","title":{"rendered":"Binance begins buying back stolen altcoins using Bitcoin, Ethereum after $6.3B hack"},"content":{"rendered":"<p> <br \/>\n<br \/><img decoding=\"async\" src=\"https:\/\/media.crypto.news\/2025\/02\/crypto-news-Binance-option35.webp\" \/><\/p>\n<div>\n<p class=\"is-style-lead\">Binance has begun buying back cryptocurrencies stolen in its $6.3 billion security breach, using company reserves and market purchases to replace affected assets in matching token amounts as investigators continue tracing the stolen funds.<\/p>\n<div id=\"cn-block-summary-block_fc2bb1291f6df20ce7acf423bbf6b9b2\" class=\"cn-block-summary\">\n<p>\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/p>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>Binance says it has reserved more than $6.34 billion to cover losses from the October 29 security breach.<\/li>\n<li>The exchange already holds $5 billion in the affected tokens and is buying the remaining assets through exchanges and OTC desks.<\/li>\n<li>Co-founder Yi He says Binance is using its SAFU fund and company holdings, including BTC and ETH, to replace stolen altcoins.<\/li>\n<li>Chainalysis has linked the attack to North Korea\u2019s TraderTraitor group and identified unusual automated laundering activity.<\/li>\n<li>Binance\u2019s Thai partner Gulf has offered liquidity assistance, although CZ says the exchange can cover its losses independently.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>As per of an October 30 company <a href=\"https:\/\/x.com\/binance\/status\/2116121748555153621\" target=\"_blank\">update<\/a>, the exchange has reserved more than $6.34 billion to cover the incident, including $5 billion already held in the same cryptocurrencies that attackers transferred from its wallets.<\/p>\n<p>Binance is purchasing the remaining tokens through cryptocurrency exchanges and over-the-counter (OTC) trading desks. The company said some purchases could take longer because certain assets have limited liquidity, while privately negotiated OTC transactions require settlement.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Binance buys stolen altcoins using company reserves<\/strong><\/h2>\n<p>Binance co-founder Yi He confirmed that the exchange was using its Secure Asset Fund for Users (SAFU) and existing cryptocurrency holdings to rebuild the affected balances.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"is-style-default\">\u201cBinance\u2019s SAFU fund and Binance\u2019s holdings include a large amount of assets such as BTC and ETH,\u201d she wrote.<\/p>\n<\/blockquote>\n<p>The company intends to purchase the stolen altcoins in fully matching quantities, with another update planned after the transactions finish.<\/p>\n<p>Although Yi He identified BTC and ETH among available reserves, Binance has not disclosed how much of either cryptocurrency it will sell to fund the purchases.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Binance\u2019s SAFU fund and Binance\u2019s holdings include a large amount of assets such as BTC and ETH. We are currently buying, through OTC and on-exchange, all the stolen altcoins in fully matching amounts. We will update everyone again once the purchases are complete.\u2026 <a href=\"https:\/\/t.co\/TTUV5nS0ec\">https:\/\/t.co\/TTUV5nS0ec<\/a><\/p>\n<p>\u2014 Yi He (@heyibinance) <a href=\"https:\/\/x.com\/heyibinance\/status\/2116124832584904742?ref_src=twsrc%5Etfw\">October 30, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>The distinction matters for the reported recovery figures. The $6.34 billion represents funds Binance says it has reserved, while the $5 billion represents affected token assets already available within those reserves. Neither figure establishes the amount of new buying that must occur on the open market.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<p>Binance said its purchase calculations exclude frozen or protected assets, which remain subject to recovery checks. The company reported $3 billion frozen through cooperation with token issuers, investigators and law enforcement.<\/p>\n<h2 class=\"wp-block-heading\"><strong>UNI, PEPE and LINK among stolen assets sold by hacker<\/strong><\/h2>\n<p>The repurchases follow large sales of stolen altcoins by the attacker, who exchanged several cryptocurrencies for Ethereum shortly after the breach.<\/p>\n<p>As <a href=\"https:\/\/crypto.news\/uniswap-price-despite-standard-chartered-forecast\/\" target=\"_blank\">reported earlier today<\/a>, on-chain tracker Lookonchain identified the sale of 7.02 million UNI worth $39.63 million.<\/p>\n<p>The attacker reportedly sold 7.77 trillion PEPE for $31.66 million, alongside 217.5 million ENA worth $33.93 million and 2.57 million LINK valued at $26.05 million.<\/p>\n<p>AAVE, ONDO and WLD were among the other affected tokens. The seven reported sales generated 70,480 ETH worth $158.25 million at the time.<\/p>\n<p>The <a href=\"https:\/\/crypto.news\/pepe-price-falls-binance-hacker-sells-tokens\/\" target=\"_blank\">PEPE sell-off<\/a> coincided with heavy volatility, although a well-known holder subsequently purchased another 45.08 billion tokens worth $206,500.<\/p>\n<p>Binance\u2019s decision to replace stolen assets in their original denominations could create demand for individual tokens. However, OTC transactions may match buyers with sellers without placing equivalent orders on public exchanges.<\/p>\n<p>The company has not published individual repurchase amounts, execution prices or a breakdown of purchases completed.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Chainalysis identifies unusual laundering activity<\/strong><\/h2>\n<p>While Binance works to restore customer balances, blockchain investigators continue tracking cryptocurrency that escaped the initial freezing efforts.<\/p>\n<p>In an October 30 investigation, Chainalysis <a href=\"https:\/\/www.chainalysis.com\/blog\/binance-exploit-latest-findings-and-response\/\" target=\"_blank\">attributed<\/a> the attack to TraderTraitor, a North Korean cybercrime group previously associated with major cryptocurrency thefts.<\/p>\n<p>The firm identified a direct connection between funds stolen from Binance and assets taken during September\u2019s Bitget exploit. Investigators said the two groups of funds entered shared wallets, strengthening their assessment of North Korean involvement.<\/p>\n<p>According to the report, attackers initially moved $500 million in stablecoins into a wallet intended to exchange assets that issuers could freeze.<\/p>\n<p>Over nearly 20 minutes, they converted $325 million in stablecoins into $285 million in ETH. The remaining $175 million was subsequently transferred to intermediary wallets.<\/p>\n<p>Investigators have since observed thousands of transactions involving repeated transfers between addresses. Some wallets receive exactly 1 TRX before processing additional funds, a pattern the firm believes suggests automated laundering.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Gulf offers Binance liquidity support after hack<\/strong><\/h2>\n<p>Binance founder Changpeng Zhao (CZ) said the exchange\u2019s Thai partner, Gulf, had offered financial assistance during the crisis.<\/p>\n<p>In his statement, Zhao recalled a similar offer following Binance\u2019s $4 billion settlement with U.S. authorities in 2023.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cKnow you can cover, but we are here if needed,\u201d he quoted the latest message as saying.<\/p>\n<\/blockquote>\n<p>Binance TH separately said its customer assets remained safe because the Thai business maintains independent custody arrangements and segregated cold wallets.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">In 2023, after news of the $4 billion fine, Gulf, our partner in Thailand, asked: \u201cdo you need help with cash liquidity?\u201d We didn\u2019t, but I appreciated the gesture.<\/p>\n<p>Today: \u201cknow you can cover, but we are here if needed.\u201d<\/p>\n<p>Strong partners show in tough times. \ud83d\ude4f <a href=\"https:\/\/t.co\/0GzOIMBwyK\">https:\/\/t.co\/0GzOIMBwyK<\/a><\/p>\n<p>\u2014 CZ \ud83d\udd36 BNB (@cz_binance) <a href=\"https:\/\/x.com\/cz_binance\/status\/2116124551386132816?ref_src=twsrc%5Etfw\">October 30, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>The local exchange temporarily suspended deposits and withdrawals for security checks, while other services continued operating.<\/p>\n<p>Binance said it would publish additional recovery updates as purchases progress and eventually verify customer holdings through its Proof of Reserves reporting.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n<p><br \/>\n<br \/><a href=\"https:\/\/crypto.news\/binance-buys-back-stolen-altcoins-after-hack\/\">Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Binance has begun buying back cryptocurrencies stolen in its $6.3 billion security breach, using company reserves and market purchases to replace affected assets in matching token amounts as investigators continue tracing the stolen funds. Summary Binance says it has reserved more than $6.34 billion to cover losses from the October 29 security breach. The exchange [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":23048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[23],"tags":[],"kronos_expire_date":[],"class_list":["post-24876","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto"],"_links":{"self":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/24876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/comments?post=24876"}],"version-history":[{"count":0,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/24876\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media\/23048"}],"wp:attachment":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media?parent=24876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/categories?post=24876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/tags?post=24876"},{"taxonomy":"kronos_expire_date","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/kronos_expire_date?post=24876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}