Binance says it has covered 90% of $6.3 billion hack losses, confirms withdrawals to reopen

Binance said on Saturday it has covered 90% of the losses stemming from the hack it suffered on October 29, an attack that drained an estimated $6.3 billion from the exchange. The platform confirmed it remains on track to reopen withdrawals on November 1, 2026, the date it had originally set when the breach came to light.

"The amount covered now reaches 90%," the exchange said, detailing that it has allocated more than $6.34 billion of its own resources to absorb the impact. Ten assets held by users — bitcoin, ether, USDT, BNB, solana, USDC, XRP, USD1, RLUSD and zcash — have been fully backed at 100% as part of this initial coverage, according to Binance.

The remaining 10% corresponds to tokens with thinner markets. "These assets are less liquid, which means it may take more time to obtain them in the required amounts," Binance said, adding that it is buying the shortfall "through market and OTC channels until the covered amount reaches 100% for all tokens." The exchange was explicit about who bears the cost: "Binance will absorb the financial impact of these stolen funds, not our users." It said it is "working with industry partners to complete the remaining acquisitions and will provide further updates as the process progresses."

To fund the replenishment, Binance drew on the Secure Asset Fund for Users (SAFU), its Futures Insurance Fund and corporate treasury resources. The exchange said it intends to rebuild SAFU back to roughly $1 billion, keeping it as a permanent emergency reserve rather than depleting it entirely to cover the shortfall.

Proof of reserves and verification

Binance took a new Proof of Reserves snapshot at 00:00 UTC on October 31, which it said "provides an updated view of the assets that are fully accounted for." Generating the accompanying zero-knowledge proof is taking between 40 and 50 hours because of the computational load involved, the exchange said, noting it "will provide an additional update as soon as the details are confirmed." Binance estimates that users holding the top ten crypto assets will be able to independently verify 1:1 backing from Tuesday, November 3.

How the breach happened

Binance's preliminary investigation traced the attack to the compromise of a DevOps engineer's laptop, which gave attackers access to a services container and allowed them to execute unauthorized transactions. Chief executive Richard Teng said the inquiry has since widened: "Our subsequent investigation has uncovered additional breach points."

For European users of the exchange, the coverage figures and the reopening timeline are the immediate points of reference, though Binance has not yet confirmed that withdrawals have actually resumed as planned, only that it remains on schedule to do so.