Binance Closes the $6.34 Billion Gap Left by October's Record Hack

Binance says it has fully replaced the $6.34 billion in customer crypto stolen in its October 29 hack, using company funds drawn from its SAFU emergency fund, its futures insurance fund and its corporate treasury. A new proof-of-reserves snapshot covering 198 tokens is out, but the zero-knowledge proof that would let users check the numbers themselves is still being generated.

Nahid Joy

Nov 14, 2026 - 11:19

0 6

A tall glass office tower bearing the yellow Binance logo and the word BINANCE in large white letters, photographed from below against a clear blue sky.

Binance Closes the $6.34 Billion Gap Left by October's Record Hack

Binance says it has finished replacing the crypto assets stolen from its customers in the October 29 security breach, closing the books on what is widely described as the largest cybertheft in history. The exchange announced on November 12 that it had committed more than $6.34 billion of company funds to buy back the affected tokens, and published a new proof-of-reserves snapshot covering 198 tokens.

The announcement marks the end of a two-week recovery effort that began hours after the hack, when Binance pledged to cover every affected balance from its own resources. It does not mean the stolen coins themselves have been recovered. The exchange bought replacement tokens on the open market and over the counter; the original funds remain largely in the hands of the attackers, who the US government and independent analysts have blamed on North Korea.

Three company funds paid for the replacements

Binance said the money came from three company-controlled sources: a partial deployment of its Secure Asset Fund for Users, known as SAFU, a portion of its futures insurance fund above the level required by its own risk-management framework, and its corporate treasury. The exchange has not published an audited breakdown of how much came from each source.

The recovery moved fast at first and then slowed. Binance reported about 90 percent of the affected assets replaced by October 31, roughly 95 percent by November 1 and about 98 percent by November 4. The final stretch took the longest: the stolen haul included lesser-known tokens beyond mainstream coins such as bitcoin, and sourcing some of those took days of extra work. A very small number of tokens that Binance no longer lists were also affected.

Binance has also committed to replenishing SAFU to approximately $1 billion after the partial draw, a step it says will keep the emergency fund fully resourced. That replenishment is a commitment, not something already done.

A wider proof of reserves, but no independent check yet

Alongside the announcement, Binance published a new proof-of-reserves snapshot taken at 00:00 UTC on November 12. It covers 198 tokens, a sharp expansion from the ten-token snapshot of October 31 and the 44-token snapshot of November 4. According to the exchange's proof-of-reserves page, bitcoin is listed at 100.05 percent, ether at 100.02 percent and USDT at 104.34 percent.

Users cannot yet check those figures for themselves. Binance said the full zero-knowledge proof for the new snapshot would take approximately 40 to 50 hours to generate because of the computational workload, and as of November 14 it was still being generated. Once it is ready, users holding affected tokens will be able to verify that their balances are backed at a minimum ratio of 1:1. Until then, the 1:1 backing is Binance's statement, not something customers can confirm on their own.

A proof of reserves is also narrower than a financial audit: it compares what an exchange holds with what users are owed, but it does not establish that the exchange has no other liabilities or operational risks.

Withdrawals still reopening in phases

Access to funds is still being restored gradually. Binance began reopening withdrawals on November 1, starting with bitcoin and then spreading to other networks, and says it will share further details once the next phases are confirmed. The exchange's own token, BNB, slipped in trading after the announcement.

US authorities move on the stolen funds

Separately, the US Justice Department announced on November 12 that more than $1.2 billion in stolen cryptocurrency is subject to court-authorized seizure or restraint, taking the broader frozen total above $2.7 billion. The FBI has attributed the attack to North Korea's TraderTraitor actors and dates the theft to around October 29.

Those law-enforcement figures describe assets intercepted by government and private-sector efforts, not money Binance has replaced for customers. The two milestones should not be confused: one restores customer balances from company funds, the other tries to take stolen coins out of the attackers' hands.

Blockchain analytics firm Elliptic has described an elaborate laundering operation behind the theft, with the stolen tokens moved through thousands of digital wallets and across multiple blockchains, and a slice of the proceeds passed through meme-coins, allowing about $430,000 of the stolen crypto to move that way.

What comes next

Three things will show whether the recovery holds. The first is the completed zero-knowledge proof for the November 12 snapshot, which will let users run the account-level check themselves. The second is the pace at which the remaining withdrawal phases reopen. The third is whether Binance follows through on replenishing SAFU to about $1 billion.

The hack itself has already had wider consequences. Binance's finance chief stepped down days after the breach, insurers are taking a closer look at crypto exchange cover, and the attribution to North Korea has put the incident at the centre of the debate over state-backed crypto theft.