Binance says 90% of hacked assets are replenished, but withdrawals remain shut

Binance said Saturday that it has replenished approximately 90% of the assets affected by a security incident it estimates caused a loss of approximately $6.3 billion, up from about 80% in its previous update. The exchange said withdrawals are still suspended and remain scheduled to resume Sunday, November 1, with specific arrangements to be announced.

The word “replenished” is important. Binance is not saying it recovered 90% of the stolen funds from the attacker. Its third recovery update says it is rebuilding customer backing with its corporate treasury, part of its Secure Asset Fund for Users and part of its futures insurance fund. That replaces the missing assets on Binance's side of the ledger while investigations and efforts to freeze stolen funds continue separately.

Ten large tokens are fully backed, Binance says

Binance listed Bitcoin, Ether, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash as fully backed at 100%. The company said the remaining 10% consists of tokens outside that group and that their lower liquidity may make them slower to acquire through market and over-the-counter channels.

Binance has not disclosed a dollar value for the remaining approximately 10%. Its second incident update separately reported an approximately $6.3 billion loss and said it had set aside more than $6.34 billion in company funds. The set-aside is not the affected-asset total and cannot support a precise estimate of the outstanding pool.

The liquidity caveat also makes the last portion different from the first. Buying a required amount of a thinly traded token can move its market price, so a percentage of assets does not translate cleanly into the same percentage of replacement cost.

The reserves proof is not complete yet

The exchange took a new proof-of-reserves snapshot at 00:00 UTC on October 31 and said the full zero-knowledge proof requires 40 to 50 hours of computation. Binance expects users of the ten named tokens to be able to verify at least one-to-one backing when that proof is complete, which it estimates will be Tuesday, November 3.

That creates two separate checkpoints. The Sunday withdrawal restart tests whether customers can actually move funds again. The Tuesday proof is meant to let users verify the disclosed backing for the ten large tokens. Neither checkpoint had occurred as of this report, so the company's 90% figure remains a company statement rather than a completed public verification.

Why the funding source matters

Binance said the replenishment uses a partial deployment of SAFU, a portion of the futures insurance fund and corporate funds. It said some of the insurance fund must remain because of regulatory requirements. The mix matters because reserve funds used for one event are no longer available in the same amount for another, even when customers do not bear a direct haircut.

The exchange's promise that users will not absorb the loss is therefore a commitment backed by its own balance sheet and protective funds, not evidence that the theft has been reversed. Readers can compare this update with the Chronicle's initial report on the security incident. The most useful next evidence will be the withdrawal reopening, the completed reserve proof, the final 100% replenishment claim and any independently documented recovery of stolen assets.

Sources: Binance recovery update No. 3, Binance's second incident update, and CoinDesk. This is market information, not investment advice.