KEY INSIGHTS
- Binance restores 90 percent of the $6.3 billion funds that were lost in the October 29 hack attack.
- The cryptocurrency exchange provided $6.34 billion in funding to recover the losses without increasing costs on customers.
- Binance targets November 1 for phased withdrawal reopening, pending security checks.
Binance has replenished approximately 90% of the cryptocurrency assets stolen in its October 29 security breach, bringing the exchange closer to restoring normal withdrawal services while continuing efforts to secure the remaining holdings. In its October 31 recovery update, the company said customer balances involving 10 major cryptocurrencies were fully backed and reiterated that it would absorb the financial impact of the $6.3 billion theft rather than transfer the losses to users.
The latest figure represents an improvement from the approximately 80% recovery reported in Binance’s previous update. The exchange has allocated more than $6.34 billion in company resources toward covering the affected assets and is targeting a phased reopening of withdrawals on Sunday, November 1, subject to the completion of security checks.
Although most of the stolen assets have been replaced, Binance said the remaining 10% consists primarily of less liquid tokens that require additional time to acquire in sufficient quantities. The company is purchasing these assets through public cryptocurrency markets and over-the-counter transactions, with assistance from industry partners.
Binance Hack Recovery Covers Major Cryptocurrency Holdings
Binance confirmed that customer holdings of Bitcoin (BTC), Ether (ETH), Tether (USDT), BNB, Solana (SOL), USD Coin (USDC), XRP, USD1, RLUSD and Zcash (ZEC) are now fully backed.
Source: That Martini Guy B
The strategy for the exchange to recover from the breach entails replacement of the lost assets without necessarily focusing on recovery of the lost amount alone. This is because part of the lost cryptocurrency has been frozen in collaboration with outside organizations, while the shortfall is covered using Binance’s own money.
The firm’s statement shows that out of the total funds set aside for recovery, about $5 billion is made up of the very digital assets that were compromised. Further, an update on their end reveals that more acquisition is underway to achieve 100% coverage of the lost tokens.
Binance’s October 31 announcement therefore marked progress from its earlier 80% replenishment estimate. However, the exchange has not yet completed the replacement process, particularly for tokens with limited liquidity.
The company has also been coordinating with industry participants to acquire the outstanding assets. Binance said both market purchases and over-the-counter transactions would form part of the effort to complete the replenishment.
Corporate Treasury and SAFU Finance the Recovery
The exchange’s financial response includes more than $6.34 billion in company resources, with funding drawn from its corporate treasury and portions of its insurance and emergency protection reserves.
Binance said approximately $3 billion in stolen assets had also been frozen through cooperation involving law enforcement agencies, blockchain intelligence companies, asset issuers and other industry partners. These frozen assets are separate from the funds the company has allocated to replace the affected customer holdings.
A portion of the Secure Asset Fund for Users (SAFU) is expected to contribute to the replenishment effort. Binance said it planned to deploy part of the reserve above its required operating level while maintaining the fund’s remaining risk-management requirements.
SAFU normally provides protection against losses associated with bankrupt trading positions and helps limit forced reductions in other traders’ positions, a process known as auto-deleveraging.
The exchange also committed to restoring SAFU to approximately $1 billion following the partial deployment. Its stated position is that the financial consequences of the breach will remain with the company rather than customers.
This commitment addresses concerns about the relationship between the stolen assets and the cryptocurrency reserves backing customer balances. A CoinDesk review of Binance’s earlier reserve disclosures found that wallets drained during the attack were among those identified as backing user holdings.
Withdrawal Restart Depends on Security Checks
Binance is targeting November 1 for a phased restoration of withdrawals, following the unauthorized movement of approximately $6.3 billion in digital assets from compromised hot wallets.
The incident occurred at approximately 20:05 UTC on October 29. The exchange said deposits and other unaffected platform services remained operational while its technical teams worked on the recovery and security response.
However, the planned withdrawal reopening remains subject to the completion of security checks. Binance has not presented the target date as an unconditional guarantee that every service will return simultaneously.
The company is also continuing its investigation into how the attackers gained access. Its initial assessment pointed toward a potentially compromised employee laptop, but subsequent findings identified additional intrusion points.
Co-CEO Richard Teng confirmed that investigators had uncovered a wider breach than initially suspected. Binance said it had found no evidence that wallet private keys were leaked, with further technical findings expected after verification.
Binance Publishes Updated Proof of Reserves
Alongside the recovery measures, Binance published a new Proof of Reserves snapshot dated October 31 at midnight UTC. The exchange reported coverage ratios of at least 100% for the named cryptocurrencies, indicating that the listed assets were fully backed in the snapshot.
The company also said a more comprehensive cryptographic proof was expected by November 3. That verification would allow customers to independently check whether their account balances were included in the liabilities reported by Binance.
Moreover, TRM Labs and Chainalysis, two companies engaged in blockchain analytics, have pinpointed the perpetrators of the hack to be TraderTraitor, which is known to operate with the backing of North Korea. President of the United States, Donald Trump, was also quoted commenting on the matter.
