Back

Binance Says It Has Covered Security Incident Losses

lite News Desk 1 min read

Binance said in a November 12, 2026, statement that it had finished covering assets affected by a security incident, with more than $6.34 billion of company money committed to the losses. Completion remains the company’s account, rather than an independently verified total of payments.

Withdrawals were still being restored in stages after the coverage announcement, according to Binance. The company said it obtained the affected tokens through both over-the-counter transactions and purchases on the market.

For holders of affected tokens, Binance said independent checks of backing at a ratio of at least 1:1 would be possible once a complete zero-knowledge proof had been generated. The company estimated that generating the proof would require roughly 40 to 50 hours. Its latest Proof of Reserves snapshot included 198 tokens, according to the statement.

Binance identified three funding sources for the coverage: its corporate treasury, a portion of the Secure Asset Fund for Users, and a portion of its futures insurance fund. It said the futures insurance money used was above the amount required under its own risk-management framework.

The company also announced a plan to restore the Secure Asset Fund for Users to roughly $1 billion. Binance described the fund as a reserve for protecting users in emergencies; replenishment was a stated plan, not a completed step.

An October 30 update had put the incident’s estimated impact at approximately $6.3 billion, according to Binance. That update linked unauthorized withdrawals to a hot wallet.

Binance’s preliminary investigation identified a possible route through a DevOps engineer’s compromised laptop, which may have provided access to a service container. The company said at the time that its investigation remained in progress, leaving that account of access as an initial finding rather than a confirmed explanation.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. Remote command execution requires HTTP/2 to be enabled; servers configured for HTTP/1.1 alone are excluded from Red Hat’s assessment.

  2. Onapsis reported no observed in-the-wild exploitation as of November 10, 2026.

  3. The flaw affects Linux systems using musl without PAM under specific password-authentication and account conditions.

  4. Exploitation requires a user to open a specially prepared message file; Outlook may then contact an attacker-controlled network destination without its usual warning.

  5. N-able advised customers running N-central on their own premises to disconnect their servers until further instructions.