Binance Says 98% of Hacked Assets Are Replaced. Here Is What That Number Covers
Binance says 98% of assets hit in the $6.3B hack are replaced. Here is what that covers, what the Proof of Reserves shows, and what is still open.
Binance co-CEO Richard Teng said on Tuesday that the exchange has replaced 98% of the assets affected in last week’s $6.3 billion Binance hack, and that customers will not carry the loss. Speaking to Fox Business reporter Darren Botelho, Teng put it plainly: “The full financial impact will be borne by us.” Binance repeated the message on X and pointed users to its Proof of Reserves as the way to check it.
It is the strongest reassurance the exchange has offered since the October 29 attack. It also needs a careful reading, because “replaced” and “recovered” mean different things, and the reserve proof does not yet cover every token.
Binance Co-CEO Richard Teng: “We now are operating, we are protecting every user, and we are extremely thankful for our users’ confidence and trust”Speaking with @DarrenBotelho on @FoxBusiness, Richard explained how Binance is protecting users and replenishing impacted assets, with 98% now restored – this is fully verifiable through our Proof of Reserves.User funds remain safe. Binance absorbs the financial impact, not our users.
— Binance (@binance) November 3, 2026
What Teng actually said
In a video message last week, Teng said Binance had set aside more than $6.34 billion of company money to cover the loss, and that about $5 billion of it was already sitting in the same tokens that were taken, including USDC, USDT, BTC, ETH and BNB. On Tuesday he said the money came from dedicated user-protection reserves such as the SAFU fund and the exchange’s futures insurance funds, which were built up over the years for an extreme event like this one. SAFU began in 2018 as a $1 billion bitcoin reserve.
The replenishment figure has climbed quickly. Binance reported roughly 80% covered in an earlier update, 90% on October 31, 95% by Monday and 98% on Tuesday. The remaining 2% is made up of less liquid tokens that Binance is still buying. It has not given a date for finishing.
Replaced is not the same as recovered
The 98% describes Binance refilling customer balances from its own pocket. It does not mean investigators have clawed back 98% of the stolen crypto. Binance says about $2.85 billion of the stolen funds has been frozen on-chain, with help from Tether, Circle, Ripple, Arbitrum and Optimism. That leaves more than half of the theft still outside Binance’s control, and some of it is moving. One wallet linked to the attacker sent about $798,000 in SOL into the privacy protocol Privacy Cash this week.
The distinction matters for the company’s finances, not for customers. Every dollar not recovered is a dollar Binance has paid out of its own reserves.
What the Proof of Reserves does and does not show
Binance’s claim that its position is “fully verifiable” rests on a zero-knowledge Proof of Reserves built from a snapshot taken at 00:00 UTC on October 31. The Block reported that the proof covers ten assets: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Reported reserve ratios were 100.04% for Bitcoin, 100% for Ether and USDT, 106.08% for USDC, 100.99% for XRP and 101.30% for BNB.
Three limits are worth knowing. The check covers ten tokens, not everything Binance lists, and Binance itself has said coverage is not complete. A proof of reserves is a snapshot in time, and it is not an audit; the US accounting watchdog PCAOB has warned against treating the two as equals. And the snapshot dates from two days after the breach, so it shows where Binance stood then, not where it stands today. A second snapshot was scheduled for November 4, with the proof taking 40 to 50 hours to generate.
So the accurate reading today is that users holding those ten assets can verify their backing. Holders of other tokens are still waiting.
Customers left, but not in a stampede
Binance froze withdrawals for more than two days, then reopened them in phases on Sunday, November 1. The first day was heavy, with about $7.4 billion in gross withdrawals according to the Wall Street Journal. Binance said net outflows stood at $4.72 billion as of Monday, around 3% of the assets on the platform, and later reports put the net figure above $5 billion.
Teng told a Hong Kong Fintech Week audience that flows had “pretty much normalized,” and Binance said on Tuesday that hourly deposits were exceeding withdrawals. Analysts quoted by Reuters read the 3% figure as a sign that customer confidence largely held.
How the attack happened, and who is blamed
Binance told reporters the breach was a campaign built over many months. According to CoinDesk, the attackers used fake job interviews, malicious developer software and compromised employee devices to reach the systems that sign wallet transactions, then drained funds through Ethereum’s EIP-7702 mechanism. Our earlier piece looks at whether EIP-7702 itself was at fault. Money began leaving at 20:05 UTC, and blockchain analytics firm TRM Labs says most of it went in about 20 minutes, spread across 10 blockchains.
The FBI has attributed the theft to North Korea’s TraderTraitor group. Pyongyang rejected the claim, and no court has made a finding on responsibility. Binance says it blocked 57 suspected North Korea-linked attempts this year and will bring in independent experts to review the incident.
What to watch next
- Whether Binance finishes buying the last 2% of affected tokens, and when.
- The results of the November 4 snapshot, and whether the proof widens beyond ten assets.
- The full post-mortem Teng has promised.
- How quickly Binance rebuilds SAFU after drawing on it.
- Whether investigators recover more of the roughly $2.85 billion that remains frozen, and what happens to the rest.
For readers following the story from the start, our original report on the record $6.4 billion hack has the first-day timeline.
