Binance replaces 90% of stolen crypto—but withdrawals and full reserve proof remain pending

The story

Binance says it has replaced about 90% of the cryptocurrency stolen in a record $6.3 billion attack, using a combination of its emergency reserve, an insurance fund and corporate money. The October 31 update is an important balance-sheet response to the theft, but it is not a technical resolution. Customer withdrawals remain suspended, the least-liquid affected tokens have not all been replaced, and the exchange's complete zero-knowledge proof of reserves is still being generated.

The attack began on October 29 and drained internet-connected wallets across multiple blockchains. Binance's second incident update put the loss at approximately $6.3 billion and said investigators initially suspected a compromised laptop before finding additional points of breach. The company said it had found no evidence that wallet private keys were leaked. Reuters reported that the bulk of the theft unfolded in roughly 20 minutes and that transaction approvals were manipulated outside Binance's normal controls. A promised technical post-mortem has not yet been published.

That uncertainty matters because the newest announcement concerns replacement, not recovery. Binance says it set aside about $6.34 billion and bought new tokens to restore backing. Funding came from part of the Secure Asset Fund for Users, or SAFU; part of the Futures Insurance Fund; and Binance's corporate treasury. The company says Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash are now fully backed. The remaining 10% consists of less-liquid tokens that may take longer to acquire.

Some stolen assets have also been frozen. Binance previously said approximately $3 billion had been immobilized on-chain with help from issuers, exchanges, investigators and law enforcement. Freezing is not the same as returning money to the exchange. Recovery can require tracing, negotiation, legal orders and control of the relevant token contracts. Bitcoin and Ether do not have issuers that can reverse transfers, while centralized stablecoin issuers can block specified addresses. The incident therefore shows both sides of centralization: concentrated custody created an enormous target, while centralized intervention helped contain part of the loss.

Independent blockchain-analysis firms TRM Labs and Elliptic describe the theft as the largest crypto heist recorded. TRM traced about $6.36 billion across ten networks, most transferred within about 20 minutes. Both firms reported patterns they associate with North Korean operators, but Binance has not publicly attributed responsibility and government agencies have not announced a final finding. The attribution should remain provisional while the investigation continues.

Binance took a new proof-of-reserves snapshot at 00:00 UTC on October 31. It says producing the related zero-knowledge proof requires 40 to 50 hours and expects users of the ten named assets to be able to verify inclusion and at least 1:1 backing on November 3. The method uses a Merkle-tree liability record and a cryptographic proof intended to let customers confirm balances without exposing other users' account data.

A successful proof would provide useful evidence that selected customer balances were covered at that moment. It would not prove that Binance's infrastructure is secure, reveal every financial obligation, or guarantee future liquidity. The U.S. Public Company Accounting Oversight Board has warned that proof-of-reserves reports are limited snapshots and do not assure customers that reserves will remain adequate or protected. The distinction is especially important when the entity publishing the data also defines the assets, liabilities and methodology included.

Withdrawals are the more immediate operational test. Binance says it remains on track to restart them on November 1 after security checks, infrastructure changes and validation. Reopening will show whether the platform can process customer exits safely under elevated demand. It will not, by itself, verify that the original vulnerability is understood. A rushed restart could expose unresolved controls; a prolonged suspension would deepen the trust problem that replenishment is meant to contain.

INNOVOX analysis: the response separates three questions that crypto platforms often collapse into one claim of safety. Solvency asks whether assets cover obligations. Liquidity asks whether those assets can meet withdrawals when users demand them. Security asks whether the systems controlling the assets can resist unauthorized transfers. Binance may be able to fund the first and manage the second while still lacking a public explanation for the failure of the third.

What to watch next is evidence that closes each gap. The November 3 proof should be reproducible and clear about scope, liabilities, collateral and excluded assets. The incident report should identify the compromised control path, the authorizations that failed and the changes made, while separating verified facts from attribution. Regulators and customers will also need to know whether frozen assets are recovered, how SAFU is replenished and whether withdrawals resume on schedule without new restrictions. Until then, replacing 90% of the stolen crypto is substantial financial remediation—not proof that the exchange has finished repairing the system that lost it.

INNOVOX analysis

Binance's ability to finance a rapid replacement prevented an asset shortfall from becoming an immediate customer loss, but it also exposes the limits of the industry's preferred trust mechanisms. A reserve proof can test selected balances at a snapshot; it cannot show that the signing controls are secure, that every liability and encumbrance is captured, or that the exchange will remain liquid under sustained withdrawals.

What to watch

Watch whether withdrawals actually reopen on November 1, whether the November 3 zero-knowledge proof is independently reproducible, and whether Binance's promised incident report identifies the control failure without compromising the investigation. Also watch how much of the frozen crypto is legally recovered rather than merely immobilized.