Binance said Saturday it had replenished 90% of token assets stolen in a hot-wallet theft it announced Thursday, using company funds rather than recovered coins, and that it remained on track to reopen withdrawals Sunday, according to a company notice and CNBC^1,2.

The exchange described the incident as involving about $6.3 billion in stolen tokens¹. Its Recovery Update #3 said it had previously set aside more than $6.34 billion in company funds and had already covered about 80% of the impacted amount, a figure it said was now 90%². CNBC noted that restored backing does not mean 90% of the stolen coins were recovered from the attacker¹.

"Binance will absorb the financial impact of these stolen funds, not our users," the company said². It listed bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as fully backed 100%^1,2.

The remaining 10% consists of tokens outside that group that are less liquid and may take longer to source, the notice said². Binance said it would keep buying those assets through market and over-the-counter channels until coverage reaches 100% for all tokens^1,2.

Replenishment used a partial deployment of the Secure Asset Fund for Users, a portion of the futures insurance fund and Binance's corporate treasury, the company said^1,2. The notice said the remaining futures insurance-fund balance is a regulatory requirement².

Binance said it took a new proof-of-reserves snapshot at 00:00 UTC on Oct. 31 and that a full zero-knowledge proof would take about 40 to 50 hours, estimated by Tuesday, Nov. 3 UTC². It said users holding the ten listed tokens could then independently verify at least 1:1 backing².

CNBC said the exchange initially described a possible compromised DevOps laptop that allowed unauthorized withdrawals, while Co-CEO Richard Teng later said the attack involved a more complex process than a single engineer's permissions¹. The same report said it was not clear who was responsible; blockchain firm TRM Labs said several features matched earlier North Korea-linked heists, an attribution Binance's Saturday notice did not address^1,2.

Withdrawals had been halted after the theft¹. The company said Sunday, Nov. 1, remained the target to reopen them, with a further update once details were confirmed². CNBC said resumption was subject to security checks and that Binance did not immediately provide additional investigation details¹. Whether withdrawals actually reopened on schedule, and whether the remaining 10% is sourced, was not established in these accounts^1,2.