Binance said on Saturday that it has replenished 90% of the cryptocurrency stolen in Thursday's $6.3 billion hack — yaani about 630 crore dollars — up from about 80% in its previous update, and that it remains on track to reopen withdrawals on Sunday, November 1. The update is a major new development in the theft Awaaz Punjab reported on October 29-30, when attackers drained the exchange's hot wallets across multiple blockchains in about 20 minutes in what analysts called the largest crypto theft on record.

Source: CoinDesk, Oct 31, 2026

Customer holdings of ten major tokens — bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC — are now fully backed, Binance said. The remaining 10% consists of less liquid tokens that may take longer to acquire in the required quantities, and the exchange said it is buying them through public markets and over-the-counter trades with industry partners.

Source: Reuters, Oct 31, 2026 (via 94.1 The Duke)

90%of the stolen assets replenished by Saturday, up from about 80% a day earlier
$6.3 billionstolen on Oct 29 — yaani about 630 crore dollars
$6.34 billionin company funds set aside to cover the losses, including $5 billion in the affected cryptocurrencies
10 tokensnow fully backed 100%: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC

Who pays — Binance says it does, not users

"Binance will absorb the financial impact of these stolen funds, not our users," the exchange's update said. The replacement is being funded through its corporate treasury and a portion of its futures insurance fund, with a partial deployment of the Secure Asset Fund for Users (SAFU) expected over the next 24 hours. Binance said it used only the portion of the futures fund above its required size, committed to restoring SAFU to about $1 billion, and noted the set-aside is separate from roughly $3 billion in stolen assets that partners have frozen on-chain.

Proof of reserves — snapshot out, full proof due Nov 3

Binance published a new proof-of-reserves snapshot taken at midnight UTC on October 31 showing coverage ratios of 100% or more for the named tokens. The full cryptographic proof, which would let users independently verify that their balances are included in the exchange's reported liabilities, is expected by November 3; Cointelegraph reported the exchange saying the full zero-knowledge proof takes about 40 to 50 hours to generate.

Attribution is still analysts' assessment, not a government finding

Blockchain firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korea-linked hacking group — an analysts' assessment that no government has confirmed. CoinDesk reported President Donald Trump addressing the breach by saying "we don't know" if North Korea was behind it and that the government is "looking at that." Co-CEO Richard Teng said on Friday that investigators had found additional breach points beyond an initially suspected compromised employee laptop.

What happens next is Sunday's withdrawal reopening, the step customers have been waiting for since withdrawals were suspended after the hack, followed by the November 3 proof of reserves. Whether the remaining, less liquid 10% is sourced as quickly will decide how completely the exchange closes the hole left by a theft more than four times the size of the $1.5 billion Bybit hack of 2025, the previous record.