Binance said Thursday that it has completed coverage of the $6.34 billion Oct. 29 hack using company funds, closing out the largest cryptocurrency theft on record two weeks after the breach, even as the exchange continues to restore customer withdrawals in phases.

In a Thursday announcement, the exchange stated that it "has completed coverage of assets impacted in the security incident" and published a new proof-of-reserves snapshot. It repeated the same message in a post on X.

The wording carries weight: coverage means Binance has replaced the affected tokens from its own books, not that it has recovered the stolen coins from the attackers. The exchange said it committed more than $6.34 billion in company funds and purchased the affected tokens through market and over-the-counter channels, drawing on a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund above the level required under its risk-management framework, and its corporate treasury.

Binance has also committed to replenishing SAFU to about $1 billion after the partial draw, a step it said would keep the fund fully resourced as an emergency user-protection reserve.

A very small number of tokens that the exchange no longer lists were also affected. Binance said those holdings will be handled under its delisting process and that users who hold them will be covered.

A wider proof-of-reserves snapshot, but no independent check yet

Binance took a new proof-of-reserves snapshot at 00:00 UTC on Nov. 12 — 7 p.m. Eastern on Wednesday — covering 198 tokens, a sharp jump from the 10 tokens included in the Oct. 31 snapshot published in the days after the breach. The new figures are now posted on the exchange's proof-of-reserves website. Broader token coverage matters because a proof can only attest to the assets a snapshot includes.

The snapshot, Binance said, "provides an updated view of assets that are fully accounted for." Users cannot yet check that claim for themselves. The instrument for that check is a zero-knowledge proof, a cryptographic method that lets an exchange demonstrate its reserves without exposing individual customer balances. According to the exchange, the full proof will take about 40 to 50 hours to generate because of the computational workload. Once it is ready, users holding the affected tokens "will be able to independently verify that their assets are backed at a minimum of 1:1."

Until the proof is complete, the 1:1 backing remains Binance's own statement rather than something customers can confirm on their own.

Withdrawals are still coming back in phases

Thursday's update does not reopen the platform all at once. Binance said it continues to reopen withdrawals in phases and will share further details once they are confirmed. The exchange first reopened withdrawals on Nov. 1, starting with bitcoin before expanding to other networks, and has kept the restart on a phased timetable since then.

The announcement does not say how much of the stolen assets have been retrieved, and it does not name an attacker. Covering customer balances leaves that recovery question unanswered. The theft, which Binance first detailed in a Nov. 3 incident report, began with a fake job interview and a poisoned developer tool, a social-engineering approach that relies on deceiving people to gain access, and drained hot wallets on Oct. 29, in what remains the largest crypto hack on record.

The exchange had already pledged more than $6.34 billion to cover customer losses in the hours after the breach, reported coverage of 90% and then 95% as it reopened withdrawals, and later said it had replenished 98% of affected tokens, with the remainder held in less liquid assets that took longer to buy. Thursday's statement is the first time Binance has said the process is complete.

Binance also said that security remains a priority and that work on its infrastructure is still underway. For customers, the immediate tests are simpler: whether the zero-knowledge proof, due in about two days, backs the new snapshot, and how quickly the rest of the withdrawal queues come back.

This article is based on reporting by Micah Zimmerman, first published on Bitcoin Magazine.