Binance Replenishes 90% of Stolen Crypto as Withdrawal Restart Nears

Binance says it has now replaced 90% of the cryptocurrency stolen in this week’s $6.3 billion breach, putting the exchange much closer to its promised withdrawal restart on Sunday.

That is real progress. It is not the same thing as a full all-clear.

According to CoinDesk, Binance says customer holdings in Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash are once again fully backed. The exchange had reported roughly 80% coverage in its previous update, so the latest figure represents a meaningful step forward in a short period.

The remaining 10% is concentrated in less-liquid tokens. Binance says it is buying those assets through public markets and over-the-counter channels, where sourcing large quantities can take longer and careless buying could move prices sharply.

The exchange’s own recovery update says the replacement assets are coming from three places: its corporate treasury, part of its futures insurance fund and a partial deployment of the Secure Asset Fund for Users, better known as SAFU. Binance says users—not the company’s customers—will be spared the financial loss.

That distinction matters. Replacing assets is different from recovering stolen funds.

Binance may eventually retrieve more of the crypto that left its wallets, but its immediate obligation is to restore the assets backing customer balances whether recovery succeeds or not.

Binance described the asset-recovery effort in this update:

Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.

The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj

— Binance (@binance) October 30, 2026

Binance also took a new proof-of-reserves snapshot at midnight UTC on October 31. The company says the public snapshot is already visible, while the full zero-knowledge proof should take 40 to 50 hours to generate and is expected by November 3.

That proof is the next important checkpoint. A company statement can describe restored balances, but cryptographic verification gives customers a way to test whether the covered assets are actually backed at least one-to-one.

The withdrawal timeline is equally important. Binance says it remains on track to reopen withdrawals on Sunday, November 1.

Until withdrawals are live and functioning normally, users still cannot independently test the practical side of the recovery.

The exchange’s preliminary investigation pointed to a compromised DevOps engineer’s laptop that allegedly gave the attacker access to a service container and the ability to submit unauthorized withdrawal transactions. Binance said it had found no evidence that wallet private keys were stolen.

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y

— Binance (@binance) October 30, 2026

The breach has been linked by blockchain investigators to North Korea’s TraderTraitor group, and partners have frozen a substantial portion of the stolen assets. Frozen funds may improve the odds of later recovery, but they do not erase the operational failure that allowed the withdrawals.

For customers, the recovery now has three separate tests: Binance must finish replacing the remaining tokens, publish verifiable reserve proof and reopen withdrawals without another disruption.

Reaching 90% is the strongest recovery signal Binance has produced since the attack. The last 10%—and the ability of customers to move their money—will decide whether this becomes a completed recovery or merely a well-funded promise.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.