Binance founder Changpeng Zhao says the exchange financed its response to the approximately $6.3 billion theft entirely from its own balance sheet, without borrowing money, raising capital or selling assets.
The statement comes as Binance reports improving deposit flows five days after the October 29 attack. Meanwhile, North Korea has denied responsibility, rejecting the US government’s attribution of the theft to state-backed hackers.
However, allocating money to cover losses and replacing every stolen token are separate milestones. Binance’s November 2 recovery update said approximately 95% of affected assets had been replenished, with purchases of less-liquid tokens still underway.
CZ Says Binance Used Its Own Balance Sheet
In his X post, Zhao wrote:
A little something that’s not mentioned, and ppl may not even think about:
Binance did not borrow money
Binance did not sell assets
Binance did not raise money
Binance covered from its balance sheet.
He added that this distinguished Binance’s response from other incidents used as comparisons.
Binance previously said it had allocated more than $6.34 billion in company funds, including $5 billion already held in the specific token assets affected. Its commitment was to absorb the financial impact rather than pass the shortfall to customers.
Zhao’s statement describes the source of that funding. It should not be interpreted as evidence that all stolen assets have been recovered from the attackers or that every replacement purchase is complete.
In its latest recovery announcement, Binance said the remaining 5% involved tokens outside its ten principal covered assets. Their lower liquidity made acquiring the necessary quantities slower.
The distinction also explains why Binance can claim to have allocated sufficient funding while continuing to buy particular cryptocurrencies.
Deposits Overtake Withdrawals as Flows Stabilize
By November 3, Binance reported that hourly deposits had begun exceeding withdrawals, indicating an improvement after the initial rush to move funds following reopening.
Its published figures show $10.97 billion in withdrawals and $5.695 billion in deposits between 06:00 UTC on November 1 and 04:00 UTC on November 3. Cumulative net outflows were approximately $5.276 billion, or 3.1% of its previously reported $171 billion in assets.
Withdrawals peaked at $1.243 billion during the hour beginning at 08:00 UTC on November 1 and subsequently declined, while deposits increased through November 2.
Positive hourly flows do not mean the cumulative outflow has disappeared. They show that, during those particular intervals, more money entered than left.
Zhao also cited public reports suggesting that only 6–10% of withdrawals went to competing centralized exchanges. He said most moved into self-custody wallets that had not yet interacted with decentralized exchanges. These remain attributed observations rather than independently established customer intentions.
A withdrawal to self-custody can reflect caution, portfolio management or temporary storage. It does not establish whether the owner intends to return.
Bybit and Bitget Show How Exchanges Can Protect Customers
Binance is not the only exchange to protect customer balances after a major theft. Following its approximately $1.5 billion February 2025 hack, Bybit restored full backing of affected customer assets. Its published timeline describes closing the ETH shortfall through bridge loans, deposits and over-the-counter purchases. Bitget likewise pledged that customers would not bear losses from its September 2026 breach, initially estimated at $351.6 million and later revised to $387.5 million.
Bitget said the incident fell within its protection fund’s coverage. These examples demonstrate successful backing or reimbursement commitments, rather than proving that every exchange always compensates every customer.
The financing differences matter. Bybit explicitly described using bridge loans, whereas Zhao says Binance avoided borrowing. Both approaches can support customer withdrawals, but they create different obligations for the companies.
Preserving account balances also does not eliminate every consequence. Customers may still experience withdrawal delays, missed trading opportunities or uncertainty while services are restricted.
FTX illustrates why exchange promises cannot replace enforceable safeguards. Its collapse involved the misappropriation of billions in customer funds, rather than simply an external hack followed by replenishment. Founder Sam Bankman-Fried received a 25-year prison sentence.
Do Exchanges Legally Have to Cover Hack Losses?
There is no universal rule guaranteeing reimbursement at every centralized exchange. Liability depends on the operating entity, jurisdiction, custody agreement, applicable law and circumstances of the loss.
The European Union’s Markets in Crypto-Assets Regulation provides a concrete example. Article 75 makes covered custody providers liable for losses resulting from incidents attributable to them, with liability capped at the assets’ market value when the loss occurred. It also requires segregation of customer assets from the provider’s own holdings.
The regulation distinguishes attributable incidents from events outside the provider’s operations or control. These provisions should not automatically be applied to every Binance customer worldwide.
DeFi presents a different structure. When users deposit into smart contracts, there may be no custodial company with an obligation and sufficient resources to replace stolen funds. Recovery can depend on recovered assets, treasury resources, governance decisions, insurance or legal claims. Compensation may be partial or unavailable.
Full recovery is nevertheless possible. After Euler’s 2023 exploit, the project recovered assets and established a redemption process for affected users. The lesson is that neither centralized custody nor DeFi provides an automatic outcome after a hack.
North Korea Denies Responsibility as Recovery Continues
The approximately $6.3 billion Binance theft occurred on October 29. Initial findings pointed to a compromised employee laptop, but Binance subsequently identified additional breach points.
North Korea rejected responsibility on November 3. Kim Yo Jong, sister of leader Kim Jong Un, described US accusations as “absurd rhetoric” and a political provocation.
The denial follows the FBI’s attribution of the theft to North Korea’s TraderTraitor operation. US investigators said they observed stolen assets being converted primarily into ETH and sought industry assistance to block laundering. North Korea’s denial disputes that attribution; it does not resolve the investigation.
Binance has also completed the zero-knowledge proof for its October 31 reserves snapshot, allowing users to verify backing for ten specified assets. Its November 2 announcement planned another snapshot covering more tokens for November 4.
The remaining tests are completion of token replenishment, broader withdrawal access and a detailed explanation of how the breach occurred.