EL7.AI
CryptoMedium•2 November 2026•
5 min read

Binance Raises Hacked-Asset Reimbursement to 95% and Opens Reserve Verification

Key Facts

1Binance estimated the impact of the hot-wallet hack at about $6.3 billion in digital assets.
2Binance said more than $6.34 billion had been allocated for coverage, including $5 billion in the affected tokens themselves.
3Coverage reached about 95% in the 1 November update, leaving 5% of the affected assets uncovered.
4The proof of reserves enabled verification that balances in 10 tokens were backed at a ratio of at least 1:1.
5Reuters reported net customer withdrawals of $4.72 billion since withdrawals resumed.

Binance said in a 2 November update that about 95% of the assets affected by the hot-wallet hack had been reimbursed, up from about 90% in its 31 October update. The exchange estimated the incident’s impact at about $6.3 billion in digital assets, after a breach at around 20:05 UTC on 29 October. On the same day, it announced the completion of independently verifiable proof of reserves covering user balances in 10 tokens. It said those balances were backed by reserves of at least 1:1. Binance’s update thus combined progress on reimbursement with a way for users to verify the backing of their balances.

Binance had said on 30 October that it had allocated more than $6.34 billion in company funds to cover losses, including $5 billion held in the affected tokens themselves. This amount allocated for coverage is greater than its estimate of the overall impact, at about $6.3 billion, and does not represent a separate estimate of the size of the loss. On 31 October, it said the amount covered had risen to 90%, compared with about 80% in the previous update. Its 1 November update put coverage at about 95%, with roughly 5% of the affected assets still unreimbursed. The exchange said the remainder consisted mainly of tokens outside the 10 largest listed assets.

In a reserve snapshot taken at 08:00 UTC+8 on 31 October, Binance said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully covered at 100%. On 2 November, it announced completion of the zero-knowledge proof tied to the snapshot and said holders of any of the 10 tokens could independently verify that their balances were backed. According to the exchange, the mechanism uses a Merkle tree and a zk-SNARK proof to show that reserves cover balances at a ratio of at least 1:1 without revealing users’ balances. The tool lets users check their balance against the published proof. Binance had announced on 31 October that it had taken the snapshot, but announced the proof’s completion and availability for verification on 2 November.

Binance said reimbursement coverage combined part of the SAFU fund, part of the futures insurance fund and the company treasury. It pledged to replenish SAFU to bring the fund back to about $1 billion. The company did not identify a single source for the coverage in its updates; instead, it presented these components as parts of the reimbursement funding. In parallel, it said its partners had helped freeze about $3 billion in affected assets on-chain through its 30 October update. The Associated Press reported roughly the same figure for assets frozen in cooperation with blockchain partners. Freezing applies to assets that could be tracked on-chain, while Binance separately announced that it had allocated funds to cover losses.

Binance described its preliminary investigation as indicating that a DevOps engineer’s laptop may have been compromised, allowing the attacker to access a service container and send unauthorized withdrawal transactions. The company added that it had found no evidence that private wallet keys had been leaked. The Associated Press cited blockchain analytics firms as attributing the attack to TraderTraitor, a group linked to North Korea. The agency also quoted former Binance founder Changpeng Zhao, who said he no longer ran the company, as expecting users’ funds to be fully covered. In a separate statement cited by Reuters, co-CEO Yi He said the priority was securing the environment before enabling withdrawals and resuming operations.

After suspending withdrawals for about 48 hours following the hack, Binance began resuming them in stages on 1 November, prioritizing assets and networks according to user demand data from the previous week. The company said the next phase, covering additional networks and assets, was scheduled for 3 November as part of a gradual restart. Reuters reported that customers had withdrawn a net $4.72 billion since the suspension was lifted on Sunday morning. That figure compares with net withdrawals of about $6 billion from the exchange over 72 hours after FTX collapsed in December 2022. In the market, Bitcoin fell to a 6-week low on Friday before recovering to about $78,000 on Monday, while Ether rebounded from a 2-month low. Spot Bitcoin exchange-traded funds recorded $643 million in outflows on Friday, alongside liquidations of leveraged positions exceeding $1.3 billion.

Binance plans to take a new reserve snapshot on 4 November covering additional tokens, then generate an updated proof, which it said would take about 40 to 50 hours to prepare because of the computational burden. This follows completion of the proof for the 31 October snapshot and its release for independent verification on 2 November. The announced date for the next phase of withdrawals covering additional assets and networks is 3 November. In comments cited by the Associated Press, Bitcoin fell 3.2% to below $79,000 on Thursday evening after news of the hack emerged. The agency said the exchange had begun restoring users’ assets, while withdrawals continued to resume gradually.