Cryptocurrency exchange Binance completed the restitution of 90 percent of the funds stolen in the October 29, 2026, attack, valued at 6.3 billion dollars, on October 31, 2026. The company plans to reopen withdrawals on November 1, 2026, after reaching an 80 percent replacement rate on October 30, 2026. The platform's management stated it will assume the entirety of the financial losses directly without passing them on to client balances.
User balances in bitcoin (BTC), ether (ETH), and eight other crypto assets are now fully backed, according to statements published by Binance on the social network X. The remaining 10 percent of stolen assets consists of low-liquidity tokens, which require longer timeframes to acquire on the market. To absorb this impact, the company set aside 6.34 billion dollars on October 30, 2026, of which 5 billion corresponds directly to the cryptocurrencies affected by the intrusion.
Coverage with corporate treasury and guarantee funds
A Binance spokesperson confirmed to Cointelegraph that the balance restitution is being funded through a combination of corporate treasury, a partial allocation from the Secure Asset Fund for Users (SAFU, an emergency reserve fund), and a fraction of its futures insurance fund. The company stated that this derivatives fund will maintain capital above the minimum requirements mandated by its risk management models. However, the spokesperson did not detail the exact percentage contributed by each mechanism or the mandatory minimum volume of the coverage fund.
The acquisition of the remaining 10 percent continues through open market purchases and over-the-counter (OTC) agreements, which are bilateral operations conducted directly outside public order books. The platform specified that these assets with lower market depth involve slower acquisition processes to avoid severe price distortions. Binance has not officially specified the exact amount of stolen assets the company has managed to recover through direct channels.
Attribution to TraderTraitor and issuer intervention
Blockchain forensics firm TRM Labs attributed the theft to the hacker collective TraderTraitor, which is linked to the North Korean government. The breach recorded on October 29, 2026, represents the largest capital theft in the history of the crypto industry by financial volume. The attackers attempted to transfer billions of dollars before asset issuers could activate countermeasures on decentralized networks.
In response to the emergency, stablecoin issuers Tether and Circle jointly blocked nearly 3 billion dollars in assets linked to the suspicious addresses. This freezing of funds is part of inter-sector coordination initiatives and is managed independently of the buyback plan executed by Binance to restore balances. These immobilization actions do not automatically reduce the exchange's accounting deficit until the relevant technical and legal processes are resolved.
External audit and cryptographic verification of reserves
Cybersecurity firm CertiK warned Cointelegraph that it requires additional information to audit and verify the 5 billion dollars that Binance claims to have acquired in replacement assets. Binance published a preliminary proof of reserves after these demands but admitted that the full cryptographic proof is still in the calculation phase. Generating the zero-knowledge proof—a cryptographic protocol that allows for the validation of solvency without revealing private keys or detailed balances—requires between 40 and 50 continuous hours of computing due to the processing load required.
The restoration of the withdrawal service on November 1, 2026, constitutes the next operational milestone to evaluate the platform's stability following the incident. The sector's attention remains fixed on the final publication of the mathematical proof of reserves to confirm physical possession of the declared funds and the final acquisition of the 10 percent of low-liquidity tokens.
