Binance has begun buying back tokens through open market and over the counter deals to replenish $6.3 billion drained from its hot wallets, while co-founder He Yi said the exchange is rebuilding its security environment and reviewing its wallets to resume withdrawals within 34 to 42 hours. Over the past eight hours, Ethena deposited 128.63 million ENA worth $24 million into Binance as the exchange acquires the remaining shortfall beyond the $5 billion in matching tokens it already holds within its $6.34 billion recovery reserve. He Yi described the breach as a complex, multi-vector attack, admitted that “we should have invested more in security earlier and established stricter standards,” and said Binance will publish a technical security audit report.

Co-CEO Richard Teng said only Binance’s own hot wallet was compromised while customer funds stored largely in cold wallets were unaffected, though CoinDesk reported that the drained addresses were listed in the exchange’s Proof of Reserves as backing user balances. Blockchain analytics firm Elliptic found that the attacker used one compromised wallet’s owner rights to pull assets from another and continued sweeping new deposits as they arrived, indicating persistent access inside the signing system rather than a single leaked private key. Out of caution following the breach, rival exchange Coinbase modified its offline key storage.