Mentioned in This Article
1. How much of the Binance hack loss has been replaced?
Binance said on October 31 that it has replaced 90% of the crypto taken in the $6.3 billion theft from its platform on Thursday, October 29, and that it remains on track to reopen withdrawals on Sunday, November 1. The exchange is covering the shortfall itself, so customer balances are not reduced. The Binance hack remains under investigation, and the company says the remaining 10% is still being rebuilt.
The latest figure is an increase from about 80% in the previous update. Binance says customer holdings of ten assets are now fully backed: bitcoin (BTC), ether (ETH), Tether (USDT), BNB, Solana (SOL), USD Coin (USDC), XRP, USD1, RLUSD and Zcash (ZEC). For users who hold those tokens, the company is describing the position as restored.
The progress matters because a replenishment of this size is a test of whether an exchange can absorb a very large loss without passing it to depositors. Binance has framed the process as an obligation of the company rather than of its customers, and its update says it will bear the financial impact of the stolen funds instead of its users.
2. What is still missing from the replacement?
The unreplaced 10% consists of less liquid tokens. Assets with thin trading markets are harder to buy in the quantities required, because large purchases can move prices and may take longer to complete. Binance says it is acquiring them through purchases on public markets and through over-the-counter (OTC) trades, working with industry partners.
Over-the-counter trades are private deals arranged directly between two parties, usually through a dealer, instead of on a public order book. For large orders in smaller tokens they are a common way to avoid pushing prices sharply higher. Using both public markets and OTC channels suggests that Binance is trying to complete the purchases quickly while limiting the market impact.
The company has not tied the final 10% to a specific completion date in the update. It has, however, given a date for reopening withdrawals, which is the milestone most customers are watching.
3. Where is the money for the replacement coming from?
Binance says the replacement assets are funded from its corporate treasury and from part of its futures insurance fund. Before the latest update, the company had already set aside more than $6.34 billion in company funds, including $5 billion held in the affected cryptocurrencies. That amount was separate from roughly $3 billion in stolen assets that partners had frozen.
A partial deployment of the Secure Asset Fund for Users, known as SAFU, is expected within 24 hours. SAFU is Binance's emergency reserve for protecting users. In ordinary conditions it covers losses from bankrupt positions in futures trading and helps limit auto-deleveraging, the forced reduction of other traders' positions when a counterparty cannot meet its obligations.
Binance says it moved only the portion of SAFU that sits above the fund's required size, and that the remainder still satisfies its risk requirements. The company has also committed to restoring SAFU to about $1 billion. Drawing on a protective reserve to cover a hack is an unusual use of the fund, which is why the statement about the required minimum is significant for futures traders.
4. Why did the exchange need to replace assets at all?
The replenishment addresses a shortfall in the assets that back customer balances. A review of Binance's earlier reserve disclosures found that wallets drained in the attack were among those listed as supporting user holdings. In other words, the stolen assets were not surplus corporate funds but part of the pool that stands behind what customers are owed.
This distinction explains the structure of the response. If customer balances are supposed to be fully backed one for one, any theft from those wallets creates a gap that must be closed for the exchange to stay solvent in the sense that matters to depositors. Replacing the assets, rather than simply writing down balances, keeps the books consistent with the promise that each deposit is matched by reserves.
It also explains why withdrawals were paused. An exchange that cannot demonstrate full backing risks a rush of customers withdrawing at the same time, and the first to leave could drain whatever remains. Restoring the assets before reopening withdrawals reduces that risk.
5. What do investigators know about the breach?
The security investigation is continuing. Co-CEO Richard Teng said on Friday, October 30, that investigators have found points of entry beyond an initially suspected compromised employee laptop. The statement indicates that the breach involved more than a single point of failure, although the company has not described the additional entry points.
Blockchain analytics firms TRM Labs and Chainalysis attribute the attack to TraderTraitor, a hacking group linked to North Korea. The group has been associated with large thefts from crypto platforms in the past. Attribution by analytics firms is based on on-chain patterns and technical indicators, and it is not the same as a formal finding by a government.
US President Donald Trump addressed the incident, saying "we don't know" whether North Korea was responsible and that the government is "looking at that." His comment shows that official confirmation of the attacker's identity has not yet been given, even as private analysts have named the group.
6. What does the new proof-of-reserves snapshot show?
Binance published a new proof-of-reserves snapshot showing coverage of 100% or more for the named tokens. The snapshot was taken at midnight UTC on October 31. A proof-of-reserves report compares the assets an exchange says it holds with the liabilities it owes to customers, and a ratio of 100% or higher means assets are at least equal to those obligations.
A snapshot is a statement about a specific moment, which means it cannot show what happened to balances before or after the time it was taken. That is why the next step is more important to users who want independent confirmation. The full cryptographic proof, which would let customers verify for themselves that their balances are included in the reported liabilities, is expected by November 3.
The difference between the two documents is the level of verification. The snapshot is a figure that Binance reports. The cryptographic proof is designed so that individual users can check inclusion of their own balance without having to trust the exchange's summary.
7. What does the response mean for Binance customers?
For customers, the practical meaning of the update depends on which assets they hold. Those with balances in the ten named tokens can take the company's statement as a sign that their holdings are fully backed again. Customers holding less liquid tokens are in a different position, since the remaining shortfall is concentrated there and the replacement purchases for those assets are still under way.
Binance has said the financial impact falls on the company, not on users, so the stated outcome is that balances remain intact. The credibility of that promise rests on the size of the funds the exchange has committed. Corporate reserves of more than $6.34 billion, combined with part of the futures insurance fund, are large enough to cover the stolen amount on paper, which is why the company can describe the loss as absorbed rather than shared.
Users also face a timing question. Even when balances are intact, a pause on withdrawals prevents customers from moving funds. For traders who need to settle positions elsewhere or who simply prefer to hold their own keys, the reopening on November 1 is the point at which confidence can be tested in practice. Exchanges that reopen smoothly after an incident tend to show that their stated reserves are real, while delays raise further questions.
8. Why do large exchange hacks draw such close scrutiny?
Centralized exchanges hold customer assets on behalf of depositors, which makes them concentrated targets. A successful intrusion can affect many users at once, and the scale of a theft measured in billions of dollars places pressure on both the company and the wider market. Attackers who steal from an exchange also need to move and convert the proceeds, which is one reason analytics firms track the flow of funds closely after an incident.
The involvement of a state-linked group would add a geopolitical dimension. TraderTraitor, as described by TRM Labs and Chainalysis, is associated with North Korea, and thefts attributed to groups connected to that country have been a recurring concern for regulators and exchanges. The government response so far has been cautious, with the US president saying the matter is being examined and that the identity of the culprit is not yet confirmed.
Proof-of-reserves reports emerged as an industry response to earlier exchange failures, giving customers a way to check that deposits are matched by assets. The reports are most meaningful when they are verifiable by individuals and not only by auditors. The cryptographic proof promised for November 3 is intended to meet that standard, and its release will show whether the exchange can back its public claims with checks that users can run themselves.
9. What happens next?
Several dates now shape the recovery. Withdrawals are scheduled to reopen on Sunday, November 1. A partial deployment of SAFU is expected within 24 hours of the update. The full cryptographic proof of reserves is due by November 3. The investigation into how attackers gained access continues, with no completion date announced.
The key measures to watch are whether the remaining 10% of replacement assets is acquired, whether withdrawals open on schedule without disruption, and whether the full proof confirms the coverage described in the snapshot. Each step will indicate how well Binance can contain a theft of this scale and how much confidence depositors place in the exchange once access to their funds resumes.