Binance Restores 90% of Hacked Assets Ahead of Withdrawal Restart

• Binance says it has restored backing for 90% of the assets stolen in the October 29 hack.
• Ten major cryptocurrencies, including Bitcoin, Ether and Tether, are now fully backed.
• Part of the money comes from insurance reserves built to protect futures traders.
• Withdrawals are planned for November 1, and the full reserve proof should follow on November 3.

Binance said on October 31 that it has restored backing for 90% of the cryptocurrency stolen in the roughly $6.3 billion breach of its hot wallets on October 29, up from 80% a day earlier, and that it still plans to reopen withdrawals on Sunday, November 1. For the first time, the update names all three pools of money behind the recovery. One of them is the insurance reserve that protects futures traders, and its use makes the incident a question about how the exchange allocates risk capital, not only a security failure.

https://t.co/FJazWAxnQX

— Binance (@binance) October 31, 2026

The 90% figure does not refer to coins recovered from the attackers. Binance is replacing the stolen assets with its own resources. A rough estimate based on the $6.3 billion loss puts the covered amount near $5.67 billion, with about $630 million still open. Binance has not published either number. On October 30, it earmarked more than $6.34 billion in company funds. That sum is what Binance set aside to fill the gap.

The missing 10% is in tokens Binance cannot buy quickly

Ten assets now have full backing: BTC, ETH, USDT, BNB, SOL, USDC, XRP, World Liberty Financial’s USD1, Ripple’s RLUSD and Zcash. They are the most liquid assets on the balance sheet, which is why Binance was able to rebuild them first.

The rest are thinner markets. In those markets, a large buy order on an open exchange can push the price up before the order is filled. Binance is splitting its purchases between public order books and over-the-counter (OTC) deals, which are trades negotiated directly with a counterparty and kept off the public market. It has not said which tokens remain short.

Money meant for futures traders is now covering a hot-wallet breach

The Secure Asset Fund for Users (SAFU), created in July 2018 for emergencies like this one, is being partly drawn down, and Binance has committed to refilling it to about $1 billion. The fund is held by Nest Clearing and Custody Limited, a regulated entity in Abu Dhabi Global Market. Part of its capital falls under reserve requirements, which limits how much can be used at short notice.

The futures insurance funds were built for a different job. When a leveraged position is liquidated and the trader’s collateral does not cover the loss, these funds pay the difference. Without them, the exchange falls back on auto-deleveraging (ADL), which forcibly cuts profitable positions on the other side of the trade. Binance says it took only the capital above the minimum its risk framework requires. The corporate treasury carries the rest.

Binance has not given a dollar split across the three sources. That leaves traders unable to see how much of their protection has been spent, at a time when the market is volatile.

A DevOps laptop, 20 minutes and no leaked keys

TRM Labs estimates that $6.36 billion left Binance across ten blockchains. It calls this the largest known crypto theft, roughly four times the $1.5 billion taken from Bybit in February 2025. The main transfer took about 20 minutes, and the preparation began at least 36 hours earlier, with the operating wallet funded through small Tornado Cash withdrawals and the code tested on other wallets first. On Ethereum, the attackers used EIP-7702, a mechanism that lets a regular wallet temporarily hand its actions to smart-contract code. TRM attributes the attack with high confidence to TraderTraitor, the North Korean unit the FBI blamed for the Bybit hack, and Chainalysis has reached the same view. Binance says it is still working with law enforcement to identify the attackers.

Binance traces the entry point to a compromised laptop belonging to a DevOps engineer, which exposed internal systems that approve wallet transactions. Investigators later found further points of compromise. The exchange says it has found no evidence that private keys leaked. If that holds, the attackers did not need the keys: they controlled the system that instructs the wallets to sign. Reuters reported that co-CEO Richard Teng described malware built to erase traces of the attack, which is slowing the forensic work.

$3 billion frozen is not $3 billion returned

Binance’s previous update put the funds frozen on-chain at about $3 billion, with help from token issuers and blockchain partners. TRM counted about $2.7 billion in the early response, involving Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council. The two figures were measured at different times and should not be added together. TRM says the attackers still control more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion. Native coins like these have no central issuer, so no one can freeze them. A freeze stops the attackers from moving the tokens, but it does not send them back to Binance. Whatever Binance eventually recovers would offset its treasury spending, on a timeline no one has given yet.

Withdrawals reopen Sunday, the reserve proof lands Tuesday

Binance took a new Proof of Reserves snapshot at 00:00 UTC on October 31. Turning it into a zero-knowledge proof, which lets each user check that their balance is backed at least 1:1 without seeing anyone else’s data, takes 40 to 50 hours of computation. Until that proof is published, the 90% figure rests on Binance’s own statement. Even after it, the proof covers only the ten named assets, and it is not a full audit of the company’s liabilities.

The reopening will be phased and depends on security checks. Its October 30 update put the restart within roughly 34 hours, which points to the early hours of Sunday UTC, but Binance has not said which networks come first. Deposits have kept working throughout. In the first days of the sell-off, Reuters reported Bitcoin at a six-week low near $76,368 and Ether at about $2,178, while BNB lost about 6.4% in 24 hours.

When hackers took 7,000 BTC from Binance in May 2019, worth about $41 million at the time, SAFU covered the full loss and withdrawals resumed after roughly a week. This loss is about 150 times larger, and SAFU alone could not cover it. Next come the promised technical post-mortem and the refill of SAFU. The remaining open question is whether Binance will publish how much each of the three pools contributed.