Binance says 90% of stolen crypto replenished, Nov 1 withdrawal restart holds

Binance said on October 31, 2026 that it has replaced 90% of the crypto drained in the October 29 hot-wallet theft, up from roughly 80% a day earlier, and that withdrawals will reopen Sunday, November 1 as planned. The exchange is funding the backfill from its own treasury, part of the futures insurance fund, and a portion of SAFU — not from users. A fresh proof-of-reserves snapshot was taken at 00:00 UTC on October 31; the full cryptographic Merkle proof is scheduled for November 3. Primary source: Binance's X post and its proof-of-reserves page. Coverage: CoinDesk, The Defiant.

What happened

Binance's update to users puts the picture at Oct 31 close as follows. Customer balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are "fully backed" by exchange reserves. The remaining 10% is in less liquid tokens that Binance is still acquiring on public markets and through OTC trades.

The quote the exchange led with: "Binance will absorb the financial impact of these stolen funds, not our users."

Three funding mechanisms are itemized in the update, per CoinDesk's review:

1. Corporate treasury — Binance had set aside more than $6.34 billion in company funds (including about $5 billion in the affected cryptocurrencies) when the breach was first disclosed.
2. Futures insurance fund — a portion is being redirected to backfill the gap.
3. SAFU (Secure Asset Fund for Users) — Binance says it is deploying only the portion of SAFU above its required size over roughly a 24-hour window, and commits to restoring SAFU to about $1 billion afterward.

These sit on top of roughly $3 billion in stolen assets that stablecoin issuers and other partners have frozen (see our Oct 31 freeze post).

Mechanism — what "fully backed" means here

Binance's proof-of-reserves program publishes periodic snapshots that attest each listed token's on-exchange reserves cover user liabilities 1:1 or better. The attestation is a point-in-time Merkle tree the user can verify against a receipt showing their own balance is included.

The Oct 31 snapshot took the audit after the drain and after the backfill. Binance co-CEO Richard Teng had said earlier that investigators found "additional points of breach" beyond the initially suspected compromised employee laptop; the firm did not update that assessment in the Oct 31 user note. CoinDesk's own review of reserve disclosures across the breach window confirmed that wallets drained in the attack had previously been listed as backing user holdings — in other words, the shortfall the replenishment addresses is the user-liability gap the drain created.

The verification path for a Binance user remains:

1. Log in; retrieve the audit receipt for the Oct 31 snapshot (expected available by Nov 3).
2. Compute the leaf hash from account ID + balances.
3. Walk the Merkle path up to the published root.
4. Confirm the root matches the exchange's attested root.

Nothing in the publicly-released material lets a non-user independently verify the full snapshot — that is the usual limitation of exchange-side proof-of-reserves and does not change here.

Numbers block

- Loss (Binance figure)                : $6.3 billion
- Replenished at Oct 31 close          : ~90%
- Replenished at Oct 30 close          : ~80%
- Still to acquire                     : ~10%, in less liquid tokens
- Set aside at disclosure              : > $6.34 billion company funds
- Of which affected cryptocurrencies   : ~$5 billion
- SAFU restoration target              : ~$1 billion
- External freezes (partners)          : ~$3 billion
- Proof-of-reserves snapshot taken     : 2026-10-31 00:00 UTC
- Full Merkle proof published          : 2026-11-03 (target)
- Withdrawals restart (target)         : 2026-11-01 (Sunday)

Figures cross-checked against the Binance X post and CoinDesk's reserve-disclosure review. The 90% / 10% split is Binance's own characterization; CoinDesk does not state an explicit unrecovered dollar figure.

Impact — on users, counterparties and the proof-of-reserves norm

The user-facing claim is clear enough: Binance has made the token side whole for the ten listed assets, and the Nov 1 withdrawal restart is the test of whether that holds up in volume. Three practical calls:

• Users: the receipt-and-Merkle-path verification is the only way a depositor independently confirms their balance is covered by Binance's attestation. Do it when the Nov 3 proof lands. Routine; do not skip because the headline number is comforting.
• Counterparties running intraday risk on Binance (market makers, prime brokers, structured-product issuers): the restart Sunday is the practical liquidity check. Replenishment on paper and net withdrawal pressure on Sunday are different stress tests.
• The industry's proof-of-reserves posture: Binance taking a 1-day backfill, cutting a snapshot, and committing to a Merkle proof three days later is the fastest post-incident PoR cycle any top-5 CEX has run. Precedent, if the Nov 3 proof verifies cleanly.

Context — the pattern against Bybit, FTX, Mt. Gox

A near-$6B custodian loss recovered inside a week against corporate funds is new territory. The relevant precedents are:

• Bybit, Feb 2025: ~$1.4B drained by the same group, replaced largely from treasury and loans within days. User withdrawals held.
• FTX, Nov 2022: shortfall was a solvency and governance failure, not an attack; recovery took years in court.
• Mt. Gox, 2014: 850,000 BTC loss, decade-long trustee-managed distribution.

Binance's framing — the attack was infrastructure, the user-liability shortfall was closed in days, and the next-week withdrawal queue is the test — only works if the Nov 1 flows settle without a visible stress event and the Nov 3 Merkle proof publishes on time. Those are the specific markers to watch.