Binance Says Company Funds Have Replaced All Assets Affected by $6.34 Billion Hack

Binance declares asset replacement complete

Binance said Thursday that it has completed coverage of assets affected by the Oct. 29 security incident, putting the total commitment from company funds above $6.34 billion. The exchange described the step as replacing the affected tokens, rather than reporting that it had retrieved the coins taken in the hack. That distinction is central: customer balances may be covered even while the status of the stolen assets remains unknown.

The announcement marks the first time Binance has said the replacement process is complete. In the hours after the breach, the exchange had pledged more than $6.34 billion for customer losses, then reported coverage of 90% and later 95% as withdrawals resumed. It subsequently said 98% of affected tokens had been replenished, with the remaining amount in less liquid assets that took longer to buy. Thursday’s update closes that coverage timeline.

Binance said it bought affected tokens through market and over-the-counter channels. The statement does not provide a token-by-token account of those purchases or explain how much came from each funding source. Its reported completion therefore addresses the exchange’s claim that impacted assets have been replaced, but the public announcement alone does not let customers assess the detailed composition of the purchases or establish whether investigators have recovered any part of the theft.

Company resources and SAFU funding

The exchange identified three sources for the funding: a partial deployment of its Secure Asset Fund for Users, or SAFU; a portion of its futures insurance fund above the level required by its risk-management framework; and its corporate treasury. Binance said the futures-fund amount was above that required level, but did not give a breakdown of the sums drawn from each source. The announcement presents the funding as a company commitment to cover affected assets.

Binance also committed to replenishing SAFU to about $1 billion after using part of it. The exchange described SAFU as an emergency reserve for user protection and said the replenishment would keep the fund fully resourced. The statement does not specify a completion date or provide a schedule for restoring the fund. For users, the commitment is a separate issue from the completed replacement of hacked assets: it concerns the reserve remaining after the partial draw.

A very small number of affected tokens are no longer listed on Binance. The exchange said those holdings will be handled through its delisting process and that users who hold them will be covered. It did not identify the tokens or describe the exact steps and timing for those cases. The assurance extends the stated coverage to holders of delisted assets, while leaving the mechanics for those users dependent on the exchange’s delisting process.

Broader reserves snapshot awaits verification

Alongside its coverage statement, Binance published a new proof-of-reserves snapshot taken at 00:00 UTC on Nov. 12, equivalent to 7 p.m. Eastern on Wednesday. It covers 198 tokens, a substantial expansion from the 10 tokens included in the snapshot released on Oct. 31, in the days following the breach. The newer figures are posted on Binance’s proof-of-reserves website, giving customers a wider view of the assets included in the exchange’s latest account.

Binance said the snapshot provides an updated view of assets that are fully accounted for, but customers cannot yet independently check the backing claim using the promised proof. The exchange said generating the full zero-knowledge proof will take about 40 to 50 hours because of the computational workload. Until that process is complete, the stated 1:1 backing remains Binance’s assertion rather than a claim users can verify for themselves.

Once the proof is ready, Binance says users holding the affected tokens will be able to independently verify that their assets are backed at a minimum of 1:1. This next step matters because publishing a broader snapshot and enabling customer-level verification are not the same thing. The source announcement gives an expected generation window, not a confirmed release time, and does not report results from a completed independent check. The proof’s availability and what users can confirm remain immediate points to watch.

Phased withdrawals leave recovery questions open

The Thursday update does not mean all withdrawals are available again. Binance said it is continuing to reopen withdrawals in phases and will share additional details once confirmed. The exchange first reopened withdrawals on Nov. 1, beginning with bitcoin and then expanding to other networks. Its latest announcement gives no complete timetable for the remaining queues, so customers still face a staged restart rather than a single reopening across the platform.

The incident began with a fake job interview and a poisoned developer tool, according to Binance’s Nov. 3 incident report, and drained hot wallets on Oct. 29. The theft is described in the source as the largest crypto hack on record. Binance’s new coverage statement does not name an attacker or say how much of the stolen assets has been retrieved. Replacing customer assets addresses the balance shortfall, but it leaves both attribution and recovery unresolved.

Binance also said security remains a priority and work on its infrastructure is ongoing, without detailing the work in this update. The practical questions now are whether the promised zero-knowledge proof supports the snapshot’s 1:1 claim and how quickly the remaining withdrawal queues reopen. The exchange has declared asset coverage complete, but the source does not settle recovery of the stolen coins, the timing of SAFU replenishment, or the schedule for all withdrawals.

Source: BitcoinMagazine