FRANCE 24 Español reported on October 31, 2026, that Binance said it had reimbursed 90% of the losses using company funds. The report followed the October 29 theft from Binance-linked hot wallets, for which estimates varied.

What the reimbursement report said

Binance had previously said it would cover all losses. The October 31 report described a reimbursement made with company funds, separate from the cryptocurrency that issuers froze after the theft.

Estimates of the October 29 theft

WIRED reported an estimated impact of about $6.3 billion. Tom’s Hardware gave an earlier developing estimate of $5.6 billion. The nine preliminary asset categories Tom’s Hardware listed add up to $5.613 billion.

WIRED, citing TRM Labs, reported that most of the assets were taken in about 20 minutes across at least ten blockchains, including Bitcoin, Ethereum, Tron and Solana. TRM Labs described at least 36 hours of preparation: the attacker tested code on two wallets, rehearsed it on a third, then installed the same code on a Binance hot wallet four hours later. A hot wallet is connected to the internet and used by an exchange to handle customer withdrawals.

Frozen tokens and reimbursement are different

Tom’s Hardware reported that about $2.4 billion in USDT, USDC and RLUSD had been frozen. Elliptic’s broader estimate, reported by WIRED, put frozen assets at about $2.8 billion; nearly all were stablecoins. The estimates describe different scopes.

Freezing tokens immobilizes them. It does not itself transfer them back to Binance or its customers, so a freeze figure is not a reimbursement figure.

Binance’s laptop statement and the suspected attribution

Binance said its initial investigation suggested that a compromised laptop may have been involved, then reported that its subsequent investigation had found additional breach points. The company described the attack as complex and said it was coordinating with law enforcement.

Separately, TRM Labs and Chainalysis assessed a possible link to TraderTraitor, a hacking group linked to North Korea. Elliptic reported overlapping indicators but did not specifically attribute the attack to the group.