Binance says it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets in a record crypto theft announced Thursday. The exchange has also said it will buy the remaining tokens through market and over-the-counter channels until coverage reaches 100%, and that it will absorb the financial impact itself rather than pass it to users. That is the right commitment to make. Customers who keep assets on a centralized exchange are trusting the company with custody, and when custody fails, the company should bear the cost.
The more important question is how Binance is paying for it. According to the report, the exchange is drawing on its Secure Asset Fund for Users, a portion of its Futures insurance fund, and its corporate treasury. Those are all resources that exist to protect customers or the firm itself, so using them is defensible. But it also means that the reserves meant for future shocks are being spent now. Users and regulators should ask what buffers remain and how quickly they will be rebuilt, rather than accepting the 90% figure as the end of the story.
The 10% still outstanding is also worth a closer look. Binance says it consists of tokens outside its top 10 that are less liquid and may take longer to source in the required amounts. That explanation may be accurate, but it leaves a gap. Customers holding those tokens will wait longer to be made whole, and the exchange has not said which assets are involved or how long sourcing will take. A commitment to 100% coverage is only as good as the timeline attached to it.
Withdrawals are set to resume by Sunday, subject to security checks, and the exchange says its investigation continues. Resuming service quickly is important, but speed should not outrank accuracy. The report notes that it still is not clear how the attack took place. Binance first pointed to a compromised DevOps engineer's laptop, then Co-CEO Richard Teng said the attack was more complex than the misuse of a single engineer's permissions. An exchange asking users to trust its security again should be able to explain, in specific terms, what failed.
The FBI's statement that North Korea was responsible adds a dimension that should not be lost in the coverage. According to the agency, the stolen assets were laundered by converting them into Ethereum, and it expects further laundering stages. TRM Labs had earlier pointed to North Korean actors and linked several features of the attack to the Bybit and KelpDAO heists. If that attribution holds, the industry faces a state-linked threat, and individual exchanges cannot solve it alone. Binance should publish the full root-cause findings it promises, and the sector should treat hot-wallet security as a shared problem with shared standards.