Binance said on October 31 that it had replaced approximately 90% of the assets affected by the estimated $6.3 billion hack, and that purchases of the affected tokens are still continuing. The same statement also set out the exchange's plans for restoring withdrawals and completing reserve verification, and reiterated that customers will not bear the losses from the incident.

The update followed an October 30 commitment of more than $6.34 billion in company funds. At that stage, about $5 billion had already been secured in the affected cryptocurrencies, and Binance had placed coverage at approximately 80% before the October 31 update.

— Binance (@binance) October 31, 2026

The latest percentage refers specifically to the replacement of the assets used to secure customer balances, and is distinct from the separate effort to retrieve the stolen funds. Binance confirmed that it would continue buying tokens until all affected assets are covered at 100%.

What Remains to Be Replenished

The exchange stated that the ten cryptocurrencies named in the update are fully supported by reserves at this point. These include BTC, ETH, USDT, BNB, and SOL, along with USDC, XRP, USD1, RLUSD, and ZEC.

The remaining 10% consists of cryptocurrencies that are not on that list. According to Binance, these tokens do not have much liquidity, which means large quantities cannot easily be sourced. That sourcing difficulty is effectively what sets the pace for reaching the 100% coverage target.

How Binance Is Funding the Replacement Assets

The company identified its corporate treasury and portions of two reserve funds as its financial resources: the Secure Asset Fund for Users (SAFU) and the Futures Insurance Fund. SAFU is a reserve fund established in July 2018 to shield users in case of emergencies — a role it has served before, most notably in May 2019, when Binance drew on the fund to cover user losses after a breach that resulted in the theft of 7,000 BTC.

According to Binance's Frequently Asked Questions (FAQ), SAFU funds will assist in buying the outstanding tokens. The company is taking this step even though Bitcoin has already satisfied its reserve requirements, and it has pledged to replenish the SAFU reserve fund to around $1 billion.

In another company update on October 31, Binance revealed a transfer of 7,499 BTC from SAFU, associated with a transaction that is easily visible on the blockchain.

Binance also said the amount withdrawn from its Futures Insurance Fund exceeded the level required under the company's risk management strategy, although the remaining balance stayed above the required amount.

The insurance fund typically helps settle deficits arising from the bankruptcy of futures positions and assists in minimizing auto-deleveraging, a process that reduces the positions of other traders when losses are not covered. The exchange notes that this fund is owned by the company, not by its users.

When Withdrawals and Reserve Proof Are Expected

Binance kept November 1 as its date to resume withdrawals. According to its announcement made on October 31, more information would be released once the arrangements are confirmed. This was an opening schedule, not a confirmation that withdrawals have resumed.

As noted in the earlier security announcement, deposits and other services that are not affected continue to operate. The resumption of full services remains contingent on the completion of security checks.

In another announcement, Binance made available a new proof of reserves snapshot as of October 31. The results have been shared on its reserves website, and the complete cryptographic proof is expected by November 3. Generating the proof is expected to take around 40 to 50 hours, and the verification process allows users to check whether their balance appears in the liability statement. Cryptographic reserve attestations of this kind became a standard transparency measure among major exchanges after the November 2022 collapse of FTX, which revealed customer balances at the failed exchange were not fully backed. The November 1 withdrawal target and the November 3 proof deadline are the nearest scheduled checkpoints in the recovery plan, running alongside the token purchases still needed to reach full coverage.

FBI Links $6 Billion Binance Hack to North Korea

The FBI pointed out that the cyber theft of more than $6 billion worth of cryptocurrencies from Binance was carried out by North Koreans. The agency named the activity TraderTraitor, an attribution previously made by TRM Labs and Chainalysis. TraderTraitor is the designation U.S. authorities use for North Korean cyber campaigns that target cryptocurrency businesses to generate revenue for the North Korean state.

The FBI, the U.S. Secret Service, and IRS Criminal Investigation observed that the stolen funds were mostly converted into ETH, with laundering expected to proceed through DeFi and instant swap platforms.

The agencies asked THORNode and RPC node owners to blacklist the transaction addresses, or their derivatives, connected to the laundering activities. The request was made for instant exchanges, DeFi exchanges, blockchain analytics companies, and other virtual assets. The outreach is aimed at the conversion points the agencies identified as the expected route for laundering the converted ETH.

The FBI also provided some of the addresses controlled by or connected to the hackers. These addresses are holding, or have held, the hacked assets.