Updated October 31, 2026. Binance says it has replenished approximately 90% of the crypto assets affected by a $6.3 billion security breach, up from 80% in its previous update. The exchange says ten major assets are now fully backed, while it continues purchasing less-liquid tokens to cover the remainder. The claim represents progress in replacing missing assets with reserves; it does not mean that 90% of the cryptocurrency stolen by the attackers has been recovered.
In its October 31 security update, Binance said it was using corporate funds, part of its Secure Asset Fund for Users (SAFU), and part of its futures insurance fund to absorb the financial impact. It also announced a new proof-of-reserves snapshot and said it expected withdrawals to begin reopening on November 1, subject to further confirmation. Those statements are the exchange’s disclosures; a completed independent verification of all affected assets was not available in the announcement.
What Happened in the $6.3 Billion Binance Hack?
Binance reported that unauthorized withdrawals followed a compromise of its hot-wallet infrastructure at approximately 20:05 UTC on October 29, 2026. Its October 30 incident update estimated the loss at about $6.3 billion in digital tokens. Hot wallets are online systems used to support operational transfers; keeping them accessible can expose an exchange to different security risks than those associated with offline storage.
The company said it contained compromised infrastructure, revoked affected authorizations and added security controls. It temporarily suspended withdrawals while reviewing the integrity of affected systems. Binance said deposits and other unaffected services remained operational; customers should check the current status of the specific service and region they use rather than assume all withdrawal routes have reopened.
An earlier company statement linked the incident in preliminary findings to a potentially compromised DevOps engineer’s laptop and unauthorized transactions submitted through a service container. The later update said investigators had identified additional possible points of breach. Binance reported no evidence at that stage that wallet private keys had leaked, but said the investigation was ongoing. Those initial observations should not be treated as a completed forensic explanation.
What Does Binance’s 90% Replenishment Figure Actually Mean?
Replenishment means replacing assets needed to support customer balances after a theft. It differs from finding the stolen coins, freezing them on a blockchain or obtaining control of them again through a recovery process. Binance’s stated objective is to hold sufficient corresponding assets to honor user balances, while separately pursuing the stolen funds with law enforcement and industry partners.
| Reported measure | What it means | What it does not prove |
|---|---|---|
| About $6.3 billion lost | Binance’s estimate of the assets taken in the incident | A final forensic or independently audited loss figure |
| More than $6.34 billion set aside | Resources Binance says it allocated to absorb the losses | That every affected token has already been replaced |
| 90% replenished | Binance’s claimed progress in restoring matching asset coverage | Recovery of 90% of the stolen coins from the attackers |
| About $3 billion frozen on-chain | Assets Binance said partners had helped immobilize in its October 30 update | That the frozen assets have been returned to Binance or its customers |
The figures describe different stages and should not be added together. In particular, previously frozen tokens are not automatically spendable reserves, and the 90% replacement percentage is not a measurement of how much stolen cryptocurrency investigators have recovered. The exchange has not published an independently audited reconciliation of all these categories in the announcements reviewed here.
Which Crypto Assets Does Binance Say Are Fully Backed?
Binance identified BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as ten assets whose customer balances it now says are backed 100%. That statement refers to the exchange’s reported asset coverage for those tokens, not a promise that each token’s market value will remain unchanged.
The outstanding roughly 10% involves other, less-liquid assets. Binance said it was still sourcing replacement tokens through exchange markets and over-the-counter transactions, which can take longer when sufficient quantities are not readily offered for sale. The company did not provide a token-by-token timetable for completing that work.
How Are SAFU, Corporate Funds and Futures Insurance Being Used?
Binance says its response draws on three funding channels. SAFU is an emergency asset fund originally created to help protect customers in extreme situations. The exchange says a portion will be used in this response and has committed to restoring SAFU’s value to approximately $1 billion. That restoration is a future commitment, not evidence that the fund already holds the target balance after the deployment.
The second source is the company’s corporate treasury. The third is a portion of its futures insurance fund, normally used to help address losses arising from futures liquidations and reduce the need for auto-deleveraging. Binance asserts that the remaining insurance balance is above the level required under its risk framework. No independently verified breakdown of the amounts drawn from each source was included in the October 31 announcement.
Customer asset reserves and the futures insurance fund should not be conflated. Binance states that its futures insurance fund is separate from user assets and is not included in the proof-of-reserves report used by customers to check their holdings.
Can Users Verify the New Binance Proof of Reserves?
Binance says it took a new asset snapshot at 00:00 UTC on October 31 and updated its proof-of-reserves page. The full zero-knowledge cryptographic proof was still being generated when the company issued its announcement; it estimated publication by November 3, 2026, citing a processing period of approximately 40–50 hours.
The exchange’s proof-of-reserves portal describes how account holders can find their verification information and check whether their balances were included in a particular snapshot. The process uses account records, Merkle-tree data and cryptographic proofs. Binance says users holding the ten specified assets should be able to check backing of at least one-to-one once the full proof is available.
There are important limits. A snapshot documents a specified point in time; it does not prove that the same balances will remain available indefinitely. Nor does a reserve calculation, by itself, establish every legal obligation, off-chain liability or operational risk of an exchange. At the time of the October 31 update, the completion and public availability of the new cryptographic proof remained a pending milestone.
When Will Binance Withdrawals Resume?
Binance said it remained on track to resume withdrawal services on Sunday, November 1, 2026, but did not announce in the October 31 update that withdrawals had already resumed. Its earlier incident briefing described restoration as phased and dependent on security checks.
For users who need to move assets, the practical next step is to monitor their account’s actual withdrawal status and Binance’s official notices. The stated target date is not a guarantee that every asset, network or local operating entity will reopen at the same time. Users should be cautious of unsolicited messages claiming to offer emergency withdrawals, reimbursement links or reserve verification outside official channels.
What Remains Unresolved After Binance’s Latest Update?
Three developments will be particularly useful to watch. First, whether Binance confirms a fully operational withdrawal schedule and explains any remaining network-specific restrictions. Second, whether it releases the complete proof promised for November 3 and users can reproduce the stated account-level checks. Third, whether a technical post-mortem establishes the attack path and documents the security changes made to prevent a recurrence.
The breach is being covered beyond Binance’s own announcements. Reuters reported the 90% replenishment statement on October 31, noting that the less-liquid remainder could take additional time to replace. Neither that reporting nor the company’s snapshot schedule should be mistaken for independent confirmation that the case is closed.
The bottom line: Binance says it has restored coverage for most assets affected by the $6.3 billion hack and committed resources to make users whole. But replacing reserves, recovering stolen tokens and proving customer balances are three separate tasks. As of October 31, the exchange’s full cryptographic proof and planned withdrawal reopening were still ahead, while the forensic investigation remained unfinished.