Binance (BNB) Replaces 90% of $6.3B Stolen in Record Hack

By Nodora News · 1 November 2026 · Updated 1 November

Binance says it has replenished 90% of the $6.3 billion stolen in its record hack, with BTC, ETH and BNB fully backed ahead of a Nov 1 withdrawal restart.

Binance (BNB) has now replenished about 90% of the crypto stolen in its record $6.3 billion hack, the exchange said on Saturday, October 31, 2026, up from roughly 80% in its previous update. Binance says customer balances in ten of its biggest assets, including Bitcoin (BTC), Ether (ETH), BNB, Solana (SOL) and XRP, are now fully backed again, and it is still aiming to reopen withdrawals on Sunday, November 1.

Key takeaways

• Binance says it has replaced about 90% of the assets taken in the October 29–30 breach, up from about 80%.
• Holdings of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now 100% backed, according to the exchange.
• The money comes from Binance's SAFU emergency fund, its futures insurance fund and company treasury.
• Withdrawals remain paused but are targeted to resume on November 1, with a full proof-of-reserves report expected around November 3.
• BNB trades near $706 on OKX, roughly 1% higher over 24 hours.

What Did Binance Announce About the Stolen Funds?

In its latest incident update, Binance said it had replenished around 90% of the cryptocurrency drained from its hot wallets, the internet-connected wallets exchanges use for day-to-day withdrawals. That is a step up from the roughly 80% figure it gave a day earlier.

The exchange named ten assets that it says are now fully backed one-to-one for customers: Bitcoin, Ether, Tether (USDT), BNB, Solana, USD Coin (USDC), XRP, USD1, Ripple USD (RLUSD) and Zcash (ZEC). Those cover the bulk of what most users hold on the platform.

The remaining 10% is made up of smaller, less liquid tokens. Binance said these may take longer to buy in the quantities it needs, and that it is sourcing them through public markets and over-the-counter (OTC) deals, which are large private trades arranged directly between parties, with help from industry partners.

Binance repeated its earlier promise that it, and not its users, will absorb the cost of the theft.

You can read the full background on the attack in our earlier report, Binance hit by record $6.3 billion hack linked to North Korea.

How Binance Is Paying for the $6.3 Billion Hack

Binance says the replacement funds are coming from three places:

• SAFU (Secure Asset Fund for Users): an emergency reserve Binance set up in 2018 to protect customers in events like hacks. Binance expects to deploy part of it within 24 hours and has pledged to top it back up to around $1 billion afterwards.
• Futures insurance fund: a pool normally used to cover losses from liquidated futures positions. Binance says the balance left after its contribution is still above the minimum its risk rules require, and that company money will refill it if it drops below that level.
• Corporate treasury: Binance had already set aside more than $6.34 billion of its own funds for the incident, including about $5 billion held in the same tokens that were stolen.

These reserves are separate from the roughly $3 billion of stolen assets that blockchain partners and stablecoin issuers have frozen on-chain since the attack.

Why the 90% Figure Matters for Binance Users

The hack drained wallets that Binance had listed as backing customer balances. A review of the exchange's earlier reserve disclosures by CoinDesk found that the affected wallets were among those counted toward users' holdings, which created a real shortfall until the assets were replaced.

Getting the ten largest assets back to full backing closes most of that gap before withdrawals reopen. It also matters for the wider market: a large exchange buying back billions of dollars of crypto in a short window can affect prices, especially for thinner tokens, which is part of why Binance is using OTC desks.

To let users check the numbers, Binance took a new proof-of-reserves snapshot at 00:00 UTC on October 31. Generating the full zero-knowledge proof, a cryptographic method that lets users confirm their balance is included without revealing anyone else's data, takes about 40 to 50 hours, so results are expected around November 3 (UTC).

BNB Price and Market Reaction

Markets were calm on the update. Prices from OKX at about 2:50 AM AEDT on November 1:

• BNB: about $706, up roughly 1% in 24 hours
• Bitcoin (BTC): about $77,550, roughly flat
• Ether (ETH): about $2,250, up about 0.9%

BNB had fallen around 6% to near $696 in the hours after the hack, as Bitcoin slipped to a six-week low near $76,400 and Ether hit a two-month low. Both have steadied since. Some other coins are still feeling knock-on effects. Tron (TRX) is down close to 8% on OKX after a short-lived rally tied to hacker conversions on its network, and Aave has reopened its lending markets, as covered in Aave reopens markets after the Binance hack. You can track live prices on Nodora Charts.

What to Watch Next After the Binance Hack

• Withdrawals reopening: Binance is targeting Sunday, November 1, but says the system will only go live once it passes security testing. This is a target, not a confirmed time.
• The last 10%: watch for updates on the less liquid tokens Binance still needs to buy.
• Proof of reserves: the full cryptographic report is expected around November 3.
• Frozen and moving funds: about half of the stolen assets remain unfrozen, and analysts say the attackers, blamed by TRM Labs and Chainalysis on North Korea's TraderTraitor unit, have already been moving and converting some of them.
• Post-mortem: Binance has promised a detailed technical report once its investigation is complete.

For now, Binance users can deposit and trade, but should expect withdrawal queues when service returns and stay alert to fake "Binance support" messages, which often spike after major incidents.

This article is for information only and is not financial advice.

#BNB #Binance #Hack #Bitcoin #Security

This article is general information, not financial advice.