The Binance hack repayment is complete, according to the exchange, which says it has covered approximately $6.34 billion in digital assets affected by the October 29 breach. Its new reserves snapshot is published, but the zero-knowledge proof needed for users to independently check the backing had not finished generating when Binance announced the coverage on November 12.
That distinction matters: Binance says customers will not absorb the loss, but the reserves claim still awaits an independent mathematical check. The FBI attributes the theft to North Korean actors known as TraderTraitor.
- Binance reported that it completed coverage of the affected assets on November 12.
- The company says it used part of its SAFU fund, excess Futures insurance funds and its corporate treasury.
- The November 12 snapshot covers 198 tokens; Binance estimated the zero-knowledge proof would take 40-50 hours to generate.
- The FBI said North Korea was responsible and asked crypto businesses to block transactions tied to the attackers’ addresses.
- About $2.85 billion was frozen or intercepted, according to Binance, but frozen funds are not necessarily recovered funds.
Timeline of the Binance hack
- October 29, 2026: Attackers accessed an internal wallet-signing service and used Ethereum’s EIP-7702 authorization mechanism, Binance said. The exchange reported that the final unauthorized transfer finalized at 23:56 UTC.
- November 1: Binance began reopening withdrawals in phases after suspending them for more than two days. According to Reuters reporting cited by Investing.com, customers withdrew a net $4.72 billion after withdrawals resumed.
- November 2-3: Binance reported that about 98% of affected assets had been replenished as of October 31 and that it was buying the remaining, less-liquid tokens. Chainalysis put frozen funds at about $2.8 billion as of November 3.
- November 12: Binance announced full coverage of the affected assets and published a new reserves snapshot. It said users would need to wait about 40-50 hours for the zero-knowledge proof.
Background: what Binance says it replaced
The breach concerned assets held in Binance wallets, rather than a loss Binance says it will pass on to account holders. The company says it covered the shortfall using three sources: a partial deployment of its Secure Asset Fund for Users, or SAFU, excess funds from its Futures insurance fund, and corporate treasury funds. Binance also said it plans to replenish SAFU to approximately $1 billion.
Binance’s announcement says the incident affected approximately $6.34 billion in digital assets. Its earlier response update described unauthorized access to an internal signing service and the use of EIP-7702. Binance’s account of the breach is available in its initial response update.
The exchange says it has published a snapshot covering 198 tokens, but a snapshot and a completed proof are not the same thing. Binance said the zero-knowledge proof would let users independently verify that assets are backed at a minimum 1:1. The proof was still being generated at the time of its November 12 announcement.
Reactions and market context
The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets on or around October 29. It urged industry firms to block transactions connected to addresses used by TraderTraitor. That attribution comes from the FBI, not from a publicly described court finding in the supplied information.
Some stolen assets were frozen quickly. The Associated Press reported that Tether froze more than $1.5 billion and Circle more than $800 million associated with the incident. Binance later put the total frozen or intercepted at about $2.85 billion. Those figures describe assets blocked from movement, not necessarily assets returned to Binance or its customers. The exchange’s replenishment claim is a separate part of the recovery.
Crypto prices were lower on November 12, but the available figures do not establish that the Binance hack caused the moves. At 21:13 UTC, CoinGecko data showed:
| Asset | Price | 24-hour change |
|---|---|---|
| Bitcoin (BTC) | $71,447 | -4.20% |
| Ethereum (ETH) | $2,015.05 | -3.06% |
| BNB | $655.34 | -4.58% |
The Crypto Fear & Greed Index registered 28, classified as Fear, on November 12. The market was broadly weak, so the daily declines should not be treated as a direct measure of investor reaction to Binance’s coverage announcement. During the initial incident, AP reported bitcoin fell 3.2% to below $79,000 on the Thursday evening of the attack.
Outlook: the proof is the next test
The next concrete milestone is publication of the zero-knowledge proof and the ability of users to verify the reserves snapshot. Until that check is available, the claim that assets are backed at least 1:1 remains Binance’s stated position rather than a completed independent verification.
Recovery is another open question. Frozen funds can remain inaccessible without being returned, and the supplied reporting does not establish how much of the stolen crypto Binance has recovered. The exchange reported unauthorized access to its wallet-signing service, and about $2.85 billion was frozen or intercepted. The evidence does not establish the status of all stolen assets.
Binance says customers will not bear this loss. The independent proof, the status of frozen assets and the promised SAFU replenishment are the details to watch next.
FAQ
Has Binance completed repayment after the Binance hack?
Binance said on November 12 that it had completed coverage of approximately $6.34 billion in affected assets. That means the exchange says it replaced the assets, not that it has publicly confirmed every stolen coin was recovered.
Can users verify Binance’s proof of reserves now?
Binance published a snapshot covering 198 tokens, but said the zero-knowledge proof would take about 40-50 hours to generate. Independent verification was therefore still pending at the time of its announcement.
Who did the FBI blame for the Binance hack?
The FBI attributed the theft to North Korea and identified the actors as TraderTraitor. It urged crypto businesses to block transactions linked to addresses used by the group.
Sources
- Binance Completes Coverage of Assets Impacted in Security Incident; New Proof of Reserves Published (www.binance.com)
- Initial Findings and Response Update (www.binance.com)
- Binance Customers Hit by $6.3 Billion Hack Are Fully Repaid, Exchange Says (BeInCrypto)
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
