Binance says it has replaced $6 billion of stolen assets using its own resources. The team plans to reopen withdrawals on November 1 and publish the full reserve proof on November 3.
Crypto exchange Binance said in its November 1 update that it had covered $6 billion of the losses caused by the hack. A day earlier, the company said it had replaced 90% of the stolen assets using its own resources. It did not say it had recovered $6 billion from the attacker.
The team plans to restore withdrawals on Sunday, November 1. It has not given an exact time or announced that the service has reopened. Binance has published figures for assets backing customer balances, while targeting Tuesday, November 3 for the full cryptographic proof behind the reserve snapshot.
In the November 1 post below, Binance says it has covered $6 billion of the loss and quotes its detailed October 31 update.
Binance’s statement that it has covered $6 billion of the loss
The post loads from X when you open it.
Which assets have been replenished?
In its third incident update, dated October 31, Binance said it held enough assets to fully back customer balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% described in that statement concerned less liquid tokens outside those ten. The exchange said it was continuing to buy through markets and over-the-counter transactions, and that sourcing some tokens could take longer.
The team had previously set aside more than $6.34 billion of company funds. Its October 30 update said about $5 billion was already held in the same tokens that had been stolen, covering roughly 80% of the loss at that stage. Binance still needs to use the money it has set aside to buy the missing tokens. In its brief November 1 announcement, the team gave no new amount or completion time for each remaining token.
Binance draws on SAFU and its insurance fund
Binance said it was using part of its SAFU user-protection fund, an allocation from its futures insurance fund and company treasury assets. In a separate October 31 post, it announced that the SAFU transfer was complete and linked to a transaction for 7,499 BTC. Binance moved the 7,499 BTC from its own fund; it did not report receiving that amount from the attacker.
SAFU was established in July 2018 as an emergency fund built up through allocations from trading fees. Binance says Nest Clearing and Custody Limited, a Recognized Clearing House regulated by the FSRA in ADGM, holds and manages SAFU. The exchange also says part of the fund serves as capital reserves for Binance’s regulatory obligations in ADGM. The company has promised to replace the money spent and restore SAFU to approximately $1 billion, but has not said it has finished. After backing BTC balances, Binance is also using SAFU to buy other missing tokens.
The futures insurance fund has a different purpose. When the exchange closes a losing position and its collateral cannot cover what is owed, the fund absorbs the shortfall. This reduces the need for the exchange to cut profitable positions on the other side automatically, a process known as ADL. Binance says it finances the fund with its own resources, including liquidation clearance fees, and that the money is not user assets.
Binance says it used only the part of the insurance fund exceeding the amount required by its own risk framework. According to the company, the remaining balance exceeds thresholds based on historical extremes and severe but plausible market conditions. It pledged to add funds when necessary, while acknowledging that no exchange can eliminate ADL entirely.
Reserve figures are public, but the full proof is pending
In the new table on its proof-of-reserves page, Binance reports balances as of 00:00 UTC on October 31. When checked on November 1, the page displayed the ratios below while its Merkle Root Hash field still read “In Progress.” The ratios compare reported net customer balances with the assets Binance says back them.
| Asset | Reserve ratio |
|---|---|
| BTC | 100.04% |
| ETH | 100.00% |
| USDT | 100.00% |
| BNB | 101.30% |
| SOL | 100.00% |
| USDC | 106.08% |
| XRP | 100.99% |
| USD1 | 100.04% |
| RLUSD | 100.83% |
| ZEC | 103.23% |
For example, the table lists net customer BTC balances of 692,186.737 BTC against 692,488.864 BTC in on-chain assets. The latter consists of 681,664.711 BTC at the exchange and 10,824.153 BTC in third-party custody. Dividing the on-chain assets by net customer balances gives the 100.04% ratio. Binance is reporting dated balances, without claiming that any particular customer has received a new payment or completed a withdrawal. The wallets were not counted independently.
The exchange said generating the full zk-SNARK proof requires 40–50 hours of computation and that it expects to publish the result on Tuesday, November 3, UTC. That replaces the Monday, November 2 target in the earlier update. The team has published the table but has yet to provide the full verification files.
A Merkle tree lets a user check whether their own record is included in an aggregate calculation. The zk-SNARK method aims to prove conditions such as non-negative net account balances and agreement with the total without exposing individual balances publicly. Binance’s March 1, 2023 explainer video introduces the combination of Merkle trees and zero-knowledge proofs. The video explains the method in 2023; it does not assess repairs following the October 2026 attack.
Binance says proof of reserves covers assets held for users, excluding its general corporate treasury and futures insurance fund. A user can check that their balance is included in the total without auditing all of the exchange’s liabilities, security controls or withdrawal service. The proof is intended to verify the specified records and mathematical conditions.
November 1 remains the withdrawal target
According to Binance’s October 30 incident account, the attack affected hot wallets at approximately 20:05 UTC on October 29 and caused roughly $6.3 billion in asset losses. The team said it had contained the incident, revoked affected authorizations and added security controls. Binance suspended withdrawals during the review, while saying deposits and other services remained available.
The team said it first identified an employee’s computer, then found additional access points. It is still investigating the full route taken by the attacker. It says it has found no evidence that private keys leaked. The approximately $3 billion previously reported frozen is separate from the amount covered with company resources; Binance has not said the frozen money has been returned to it.
The team plans to reopen withdrawals in phases after completing security checks. On October 31, Binance kept its November 1 target and said it would provide more information once the reopening was confirmed. It has not announced the order in which networks will reopen or when each pending request will complete.
