Binance says it has completed coverage of assets affected by the October 29 Binance hack, committing more than $6.34 billion from company funds. Announced November 12, the coverage does not mean stolen funds have been recovered. Customers are still waiting for the promised proof and the completion of phased withdrawals.
Key Takeaways
- Binance says it replaced affected customer assets using its SAFU fund, futures insurance resources and corporate treasury.
- A proof-of-reserves snapshot covers 198 tokens. Binance estimates its zero-knowledge proof will take 40 to 50 hours to generate.
- Withdrawals are reopening in stages, and Binance has not disclosed how much stolen crypto it recovered.
- Bitcoin, Ethereum, BNB, XRP and Solana were all lower over the 24 hours to November 12 at 22:13 UTC, according to the supplied market data.
What happened in the Binance hack response
In its November 12 announcement, Binance said coverage of affected assets was complete. Bitcoin Magazine reported that the exchange committed more than $6.34 billion and bought replacement tokens through market and over-the-counter channels. Binance’s official announcement also says coverage is complete.
Binance said it used a partial deployment of its Secure Asset Fund for Users (SAFU), futures insurance funds above the level required by its risk framework, and corporate treasury resources. It committed to replenishing SAFU to about $1 billion.
Replacing customer balances is not the same as retrieving the attacker’s coins. Binance did not disclose how much it recovered or identify an attacker in this update.
The proof-of-reserves snapshot was taken at 00:00 UTC on November 12 and covers 198 tokens, up from 10 in the October 31 snapshot. Binance expects the full zero-knowledge proof to take 40 to 50 hours to generate. After it is ready, holders of affected tokens are expected to be able to check whether their balances are backed at least 1:1.
Until users can check the proof, the stated backing remains Binance’s claim, not an independently verifiable result. Binance says affected tokens it no longer lists will be handled through its delisting process, with holders covered.
Background and context for the Binance hack
The breach took place on October 29. Binance’s November 3 preliminary update estimated the impact at about $6.34 billion and said approximately $2.85 billion had been frozen or intercepted. The exchange said the figure was subject to reconciliation and market-price volatility, so it was not a final recovery total.
Binance described unauthorized access to an internal wallet-signing service and transfers outside the normal withdrawal process. According to the company’s preliminary incident update, five hot wallets sent 233.46 million XRP to an attacker-controlled address between 17:05 and 17:09 Brasília time on October 29.
The Block reported that Binance described a months-long intrusion involving a fraudulent recruitment approach, malware, stolen credentials and an internal AI tool. A compromised employee computer and access to the tool reportedly helped attackers reach wallet infrastructure before deploying a malicious script. The incident involved access to internal systems and employee credentials, according to the reported account.
On October 31, the FBI attributed the theft to North Korea’s TraderTraitor activity and urged crypto services to block transactions linked to listed addresses. That is the agency’s assessment. Binance’s November 12 announcement did not name an attacker or disclose how much of the stolen assets had been retrieved.
According to Bitcoin Magazine, Binance previously reported coverage levels of 90% and then 95% as withdrawals resumed. It later said it had replenished 98% of affected tokens, with less liquid assets taking longer to source. The November 12 statement was the first time it said coverage was complete.
Crypto market data on November 12
Several large crypto assets fell over the 24 hours to November 12. CoinGecko data at 22:13 UTC showed bitcoin down 4.04% and BNB down 4.72%. These figures describe market movements and do not show that Binance’s announcement caused the declines.
| Asset | Price | 24-hour change | As of |
|---|---|---|---|
| Bitcoin (BTC) | $71,411 | -4.04% | November 12, 2026, 22:13 UTC |
| Ethereum (ETH) | $2,012.49 | -2.83% | November 12, 2026, 22:13 UTC |
| BNB | $653.03 | -4.72% | November 12, 2026, 22:13 UTC |
The Crypto Fear & Greed Index was 28, or Fear, on November 12. It reflects wider market sentiment, not only reactions to the Binance hack. The Washington Post reported that Binance saw $3.6 billion in net withdrawals in the first nine hours after withdrawals resumed, about 2% of the $171 billion in assets it managed at the time. That reported outflow is separate from Binance’s replacement of affected customer balances.
Reserve coverage claims do not resolve questions about asset recovery or the breach. A zero-knowledge proof may let users verify specific backing claims, but the evidence provided does not indicate that it will establish whether stolen assets were recovered or assess Binance’s wider controls.
What to watch next
The immediate test is whether Binance publishes the promised proof within its estimated 40-to-50-hour window and whether affected-token holders can check their balances independently. The snapshot covers 198 tokens, while the stated verification is for holders of affected assets.
Customers are also waiting for details on phased withdrawals. Binance said it would share more once confirmed, but gave no schedule for completing the reopening or details of remaining network-specific restrictions.
Asset recovery remains unresolved. Replacing customer balances addresses the reported shortfall, but Binance has not said whether more funds have since been traced, frozen or returned. The FBI’s attribution and request to block listed addresses do not establish that stolen assets have been recovered.
Binance has also said it will replenish SAFU and that security remains a priority while infrastructure work continues. Further public updates will help customers assess its response. The Binance hack has put reserve transparency and centralized exchange security under scrutiny.
FAQ
Did Binance recover the money from the Binance hack?
Binance says it replaced affected customer assets, but its November 12 announcement did not disclose how much stolen crypto it recovered. Coverage and recovery are separate issues.
How will customers verify Binance’s proof of reserves?
Binance says a zero-knowledge proof will follow its 198-token snapshot and let holders of affected tokens check for at least 1:1 backing. It estimated generation would take 40 to 50 hours.
Are Binance withdrawals fully open again?
No. Binance said withdrawals were reopening in phases and that it would share details once confirmed. It gave no completion date.
Sources
- Binance Completes Coverage of Assets Impacted in Security Incident; New Proof of Reserves Published (www.binance.com)
- Binance October 29 Security Incident: Preliminary Findings and Response Update (www.binance.com)
- Binance Says It Has Fully Covered the $6.34 Billion Hack With Company Funds (Bitcoin Magazine)
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
