Binance Says It Has Replenished 95% of Assets Affected by $6.3 Billion Security Breach

Cryptocurrency exchange Binance says it has replenished approximately 95% of the digital assets affected by a security breach estimated at $6.3 billion, as it continues efforts to restore user confidence following one of the largest reported incidents in the digital asset industry.

The exchange said the incident involved unauthorized withdrawals from its hot wallets on October 29, 2026. Binance has committed to covering the financial impact through its corporate treasury and other internal funds rather than passing the loss on to customers.

The recovery update follows a series of announcements in which Binance outlined its response, including asset replenishment, efforts to freeze stolen funds, withdrawal-service restoration and an updated proof-of-reserves process.

Binance reports 95% asset replenishment

In its November 2–3 recovery updates, Binance said approximately 95% of the affected assets had been replenished. The exchange had previously reported that it had covered 90% of the impacted amount on October 31.

Binance said it had set aside more than $6.34 billion in company funds to cover the incident. The funding sources include its corporate treasury, a partial deployment of the Secure Asset Fund for Users (SAFU) and a portion of its Futures insurance fund.

The exchange said it was purchasing remaining affected tokens through market and over-the-counter channels. It also noted that the outstanding portion consisted of tokens outside the ten major assets included in its initial proof-of-reserves snapshot. These tokens were described as less liquid and potentially more difficult to source in the required quantities.

The reported 95% replenishment figure is Binance’s own recovery update. It should not be confused with the amount of stolen assets recovered from the attacker. Replenishment refers to the exchange replacing affected assets from its own resources, while asset recovery involves tracing, freezing or regaining funds taken by the attacker.

What happened in the breach?

Binance said its hot wallets were compromised on October 29, leading to unauthorized withdrawals. Its initial investigation suggested a possible compromise involving an employee’s laptop, but the exchange later said investigators had identified additional points of breach.

The exchange has said it found no evidence that wallet private keys were leaked. However, it has not yet published a complete technical post-mortem detailing the full attack sequence and all contributing factors.

Blockchain analysis firm Bitquery reported that approximately $6.3 billion in assets moved from Binance hot wallets across multiple blockchain networks during the incident. Its analysis traced transfers and examined assets that were subsequently frozen or remained under the attacker’s control.

The precise asset breakdown and attack mechanics should be attributed to the relevant blockchain analytics reports until Binance releases its complete technical investigation.

Blockchain partners froze some assets

Binance said it worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected funds.

Its October 30 update said approximately $3 billion had been frozen on-chain at that stage. Subsequent blockchain analysis published by Bitquery reported a lower, more specific figure of approximately $2.7 billion locked by issuers and protocols as of November 2.

Stablecoin issuers Tether and Circle were among the organisations that froze funds associated with the incident. These freezes can prevent affected tokens from being transferred or redeemed, depending on the asset and the issuer’s controls.

However, freezing assets is not the same as returning them to the exchange. The funds may remain locked while investigations and recovery processes continue.

Proof of reserves and asset backing

Binance also published an updated proof-of-reserves snapshot as part of its recovery response.

The exchange said the snapshot included ten major tokens: Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash. Binance reported that these assets were fully backed at a minimum 1:1 ratio in the snapshot.

The exchange subsequently said the zero-knowledge proof associated with the snapshot had been generated, allowing users holding the listed tokens to verify the backing of their balances.

Proof of reserves is a tool for checking whether an exchange holds assets corresponding to specified customer liabilities. It can provide useful transparency, but it is not a complete audit of an exchange’s financial condition, cybersecurity or operational resilience.

A proof-of-reserves snapshot also represents holdings at a particular point in time. It does not independently establish that all risks have been eliminated or that the exchange cannot experience another security incident.

Withdrawal restoration and platform operations

Binance initially suspended withdrawals while it conducted security reviews and remediation work. The exchange said deposits and other unaffected platform services remained operational during the response.

The company later announced plans to restore withdrawal services progressively. The restoration process was linked to completing security checks and validating the affected systems.

Because the exchange’s service status can change, users should check Binance’s official status notices for the current availability of withdrawals on specific networks and assets. A phased reopening should not be interpreted as proof that all networks or assets are fully operational.

What the incident means for crypto exchange security

The breach highlights the financial and operational risks associated with cryptocurrency exchange infrastructure.

Hot wallets are designed to support transactions and withdrawals, but they are also connected to systems that must be protected against unauthorized access. Security depends on more than private-key protection: employee devices, service permissions, signing workflows, infrastructure controls and emergency response procedures can all matter.

The incident also demonstrates the importance of distinguishing between an exchange’s ability to replace affected customer assets and its ability to prevent future breaches.

Binance’s reported replenishment may help protect user balances from the immediate financial impact. It does not, on its own, resolve questions about the attack’s cause, the effectiveness of internal security controls or the long-term implications for trust in centralized exchanges.

What happens next?

The next milestones include completion of Binance’s technical investigation, further recovery efforts and continued updates on asset replenishment and withdrawal restoration.

The exchange has said it intends to publish a detailed post-mortem after the facts have been verified and disclosure will not compromise the ongoing investigation.

For users and investors, the most important developments will be whether Binance provides a transparent account of the incident, demonstrates that the vulnerabilities have been addressed and maintains clear information about asset backing and platform operations.

The reported 95% replenishment is a significant financial recovery measure. But the longer-term assessment of the incident will depend on the remaining asset coverage, the final technical findings and the exchange’s ability to demonstrate stronger security controls.

---