Binance said on Saturday, October 31, that it had replaced 90% of the cryptocurrency taken in the $6.3 billion theft from its wallets on Thursday, October 29, and that reopening withdrawals on Sunday, November 1, stayed on schedule. The figure, published in the exchange's third recovery update of the incident, rose from about 80% in the update before it. Ten tokens now carry full backing, led by bitcoin, ether and BNB. USDT, SOL and USDC follow, with XRP, USD1, RLUSD and ZEC completing the ten. Each of those ten, Binance said, sits at 100% backing against customer balances.
Ninety percent of $6.3 billion is $5.67 billion, and 10% is $0.63 billion. That arithmetic frames the weekend: $5.67 billion of replacement buying is done, $0.63 billion of less liquid tokens is still to be bought, and the Sunday restart is the first live test of whether the rebuilt system holds under real customer demand.
Co-chief executive Richard Teng put the commitment in personal terms on X on Saturday: "We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident." The line matters because it repeats, in a named executive's voice, the pledge Binance made in the first hours of the incident: customers do not absorb the loss, the company does.
How the story developed
Late on Thursday, October 29, unauthorized transfers drained about $6.3 billion from Binance wallets. Withdrawals stopped at 22:15 UTC that evening, which was 03:15 PKT on Friday, October 30. Trading on Binance Alpha, the venue's early-stage token platform, paused at 23:06 UTC, and a full deposit-and-withdrawal suspension followed shortly after midnight.
Friday brought the first hard numbers. Binance said it had earmarked over $6.34 billion of company funds, including about $5 billion already held in the same cryptocurrencies that were taken, per CoinDesk. Roughly $3 billion of stolen assets had been frozen by issuers and partners. Teng said investigators had found further entry points in addition to a laptop initially thought compromised. TRM Labs and Chainalysis attributed the theft to TraderTraitor, a group linked to North Korea, while Binance had not independently confirmed the identity of those behind the attack. Coinbase, Kraken and OKX each announced security changes on Friday, October 30, which MarketRadar covered the same day.
The recovery ledger
Binance funded the replacement buying from three pools: its corporate treasury, a slice of its futures insurance fund, and a partial deployment of its Secure Asset Fund for Users, known as SAFU. CoinDesk reported that the futures-fund slice came only from the portion above the fund's required size, and that a partial SAFU deployment was expected within 24 hours of the Saturday update. Binance also committed to restoring SAFU to about $1 billion.
| Recovery item | Figure |
|---|---|
| Total stolen, October 29 | $6.3 billion |
| Replenished by October 31 | 90%, or $5.67 billion |
| Still to be bought | 10%, or $0.63 billion |
| Company funds earmarked | Over $6.34 billion |
| Already held in stolen tokens | About $5 billion |
| Stolen assets frozen by partners | About $3 billion |
| SAFU restoration target | About $1 billion |
The $6.34 billion earmarked exceeds the $6.3 billion theft by about $0.04 billion. The frozen $3 billion equals about 47.6% of the stolen total, so close to half the theft is immobilized before recovery purchases are counted.
What changed since the last update
Comparison with the previous update gives the clearest measure of pace. On October 30, coverage stood at about 80%. On October 31, it stood at 90%, a 10-percentage-point gain in one day, equal to about $0.63 billion of additional replacement buying.
| Update | Coverage | Implied amount replaced |
|---|---|---|
| October 30 | About 80% | About $5.04 billion |
| October 31 | 90% | $5.67 billion |
| Change in one day | +10 percentage points | About $0.63 billion |
The remaining 10% is the harder part by Binance's own description: tokens outside the ten fully backed assets, trading in thinner markets, taking longer to accumulate in the quantities required. Binance said purchases run via open markets and OTC channels, working with industry partners, until every affected asset reaches 100% coverage. Thin markets punish rushed buying, so the last $0.63 billion could take longer per dollar than the first $5.67 billion did.
Proof of reserves is the verification leg. Binance published a fresh snapshot taken at 00:00 UTC on October 31, which was 05:00 PKT the same day. The full zero-knowledge proof, which lets a customer check independently that their own balance sits inside the exchange's reported liabilities, takes 40 to 50 hours to generate, and Binance expects it by Tuesday, November 3. Holders of the ten fully backed tokens should then be able to verify backing at a minimum ratio of 1:1. Until that proof lands, the 90% figure rests on Binance's statement plus the snapshot, not on customer-verifiable cryptography.
Why it matters
A withdrawal restart is a different kind of test from a coverage percentage. Percentages can be announced; withdrawals have to work, in order, at scale. Binance rebuilt its withdrawal service and related addresses during the pause, and Sunday is when customers find out whether that rebuild holds. A smooth restart closes the most urgent chapter: access to funds. A delayed restart reopens the question the 90% figure was meant to settle.
MarketRadar's snapshot at 19:41 UTC on October 31 put bitcoin at $77,499, up 1.22% over 24 hours, and ether at $2,253, up 1.07%. Those prints suggest traders treated the Saturday update as progress rather than as a fresh shock. Prices are point-in-time observations, not a verdict.
What to watch
- Sunday, November 1: whether withdrawals reopen inside the stated timeframe, and whether any token or network reopens later than the rest.
- Tuesday, November 3: the full zero-knowledge proof of reserves, and whether holders of the ten tokens can verify 1:1 backing.
- The last 10%: purchase pace for less liquid tokens, and any price dislocation caused by Binance's own buying.
- Frozen funds: whether the roughly $3 billion frozen total grows as partners trace more stolen stock.
- SAFU: the partial deployment over the 24 hours after the Saturday update, and progress toward the roughly $1 billion target.
- Attribution: whether officials confirm the TraderTraitor link drawn by TRM Labs and Chainalysis, after United States President Donald Trump said on Friday that the government was looking at North Korean involvement.
Key points
- Coverage reached 90% of the $6.3 billion stolen on October 29, up from about 80% in the previous update.
- ZEC, RLUSD, USD1, XRP, USDC, SOL, BNB, USDT, ether and bitcoin are fully backed at 100%.
- The remaining 10%, about $0.63 billion, consists of less liquid tokens outside those ten.
- Funding came from the corporate treasury, part of the futures insurance fund, and a partial SAFU deployment.
- A fresh proof-of-reserves snapshot was taken at 00:00 UTC on October 31, with full cryptographic proof expected by November 3.
- Withdrawals stayed on track to reopen on Sunday, November 1, subject to a further confirmation update.
- Binance earmarked over $6.34 billion, with about $5 billion already held in the affected tokens and about $3 billion frozen by partners.
MarketRadar take
The 90% figure changes the shape of the incident without ending it. Direct customer-loss risk now concentrates in the last 10% and in the mechanics of the Sunday restart, not in the headline $6.3 billion hole. Weight two dates above the percentage itself: Sunday, for access, and Tuesday, for verifiable proof. If both land cleanly, the incident becomes a case study in balance-sheet absorption. If either slips, the percentage will read as a promise ahead of delivery, and crypto sentiment will price that gap first.
