Binance Says 90% of Stolen Crypto Replaced as November 3 Proof Nears

Published October 31, 2026, 08:45 PM PKT. Based on Binance's Saturday update of October 31, 2026, as reported by CoinDesk and CryptoBriefing on October 31, 2026, and on Binance's Security Incident Update #2 of October 30, 2026 for the prior figures and timetable. The 90% figure, the fully backed token list, and the November 3 proof date are Binance's own statements as reported by those outlets, not independently verified reserve data.

Binance said on Saturday, October 31, 2026 that it has replenished 90% of the cryptocurrency stolen in its October 29 hack, and that it remains on track to reopen withdrawals on Sunday, November 1. The figure is up from about 80% in the exchange's previous update, according to CoinDesk, and it moves the recovery from a funding promise to a mostly completed restocking job two days after roughly $6.3 billion left the exchange's hot wallets. Binance said customer holdings of ten major assets are now fully backed: bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% consists of less liquid tokens that Binance said may take longer to acquire in the required quantities, and the exchange said it is buying them through public markets and over-the-counter trades, working with industry partners to complete the purchases. The update repeats the line Binance has used since October 30: "Binance will absorb the financial impact of these stolen funds, not our users."

90% replaced, up from about 80%

The step from about 80% to 90% is the first measured progress on the buyback since Binance laid out its plan on October 30. In Security Incident Update #2, signed by co-CEOs Yi He and Richard Teng, the exchange said it had set aside more than $6.34 billion in company funds, with $5 billion already held in the exact tokens that were stolen. That reserve was separate from roughly $3 billion in stolen assets that industry partners had frozen on chain, a figure that has not changed in the Saturday reporting. At 90% of a roughly $6.3 billion loss, about $5.67 billion in replacement assets is now in place, leaving roughly $630 million still to buy, concentrated in the thinner tokens. The Saturday update does not break down how much of the ten percentage point gain came from market purchases, over-the-counter deals, or project treasuries sending tokens back, as Ethena-linked wallets appeared to do with 128.63 million ENA earlier on October 31, a flow covered in our previous report that neither Binance nor Ethena has confirmed as part of the buyback. Readers should also keep the two pools distinct: frozen assets are not recovered assets, and Binance has not said how much stolen crypto is actually back under its control.

Ten tokens now fully backed

The fully backed list is the part of the update that most directly answers customer balances. Binance said holdings of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now backed at 100% or more, CryptoBriefing reported, after the exchange published a new proof of reserves snapshot based on asset balances recorded at 00:00 UTC on October 31. The token-for-token detail matters here. Binance is replacing each stolen altcoin with the same token rather than with bitcoin or ether, so that its reserves match customer balances one for one. Repaying stolen ENA or RSR with BTC or ETH would cover the dollar value but would leave those tokens' reserve ratios below 100%, and a CoinDesk review of Binance's earlier reserve disclosures found that wallets drained in the attack were among those the exchange listed as backing users' holdings. That is why the Saturday snapshot, rather than the headline 90% figure alone, is the number customers holding the ten named tokens can check against their own balances, once the full proof arrives.

A midnight snapshot, and a November 3 proof date

The November 3 date refines the timetable Binance gave on October 30. Update #2 had pointed to an initial proof of reserves snapshot within 12 hours and results by November 2. The Saturday update says the snapshot was taken at midnight UTC on October 31, shows coverage ratios at 100% or more for the named tokens, and that generating the full cryptographic proof will take approximately 40 to 50 hours, with results expected by November 3, CryptoBriefing reported. That full proof is a zero-knowledge proof, which would let users independently verify that their balances are included in Binance's reported liabilities, according to CoinDesk. Until it lands, the snapshot is Binance's own statement of its balances, not user-verifiable evidence. The November 3 proof is therefore the first hard test of the whole recovery plan: it will show whether the remaining 10% gap closed in time, whether the ENA inflow and other project flows were part of that close, and whether the ten named tokens really sit at or above full backing.

SAFU, the futures fund, and the Sunday withdrawal test

Binance also spelled out how the replacement is being paid for. The exchange said the replacement assets are funded through its corporate treasury and a portion of its futures insurance fund, with a partial deployment of the Secure Asset Fund for Users, or SAFU, expected over the next 24 hours, according to CoinDesk. SAFU, established in 2018, is the emergency reserve meant to protect users in cases such as security breaches. Binance said it moved only the portion of the futures fund above its required size, that the remaining fund still meets its risk-management requirements, and that corporate funds would top it up if the balance fell below the required level. The exchange also committed to restoring SAFU to about $1 billion. On withdrawals, nothing in the Saturday update changes the target: the service, frozen since the evening of October 29, is expected to reopen on November 1 in phases, subject to security checks, with deposits and unaffected services already operational. The security investigation remains open. Co-CEO Richard Teng said on Friday that investigators had found additional breach points beyond an initially suspected compromised employee laptop, and attribution remains unconfirmed by Binance: TRM Labs and Chainalysis have tied the theft to North Korea's TraderTraitor group, while US President Donald Trump said on October 30 that the government is examining the question. The phased reopening on Sunday, and then the November 3 proof, are the two checkpoints that will show whether the recovery plan is holding.

This article is news reporting and is not investment advice.

Sources

• Binance, Saturday update, October 31, 2026, as reported by CoinDesk and CryptoBriefing (primary source for the 90% replenishment figure, the ten fully backed tokens, the midnight UTC October 31 proof of reserves snapshot, the November 3 full cryptographic proof date, the SAFU deployment within 24 hours and restoration to about $1 billion, and the Sunday, November 1 phased withdrawal target)
• CoinDesk, Binance says it has replaced 90% of stolen crypto after massive $6.3 billion breach (published October 31, 2026, secondary source for the 90% figure against about 80% previously, the ten fully backed tokens, the $6.34 billion reserve and $5 billion already held in matching tokens, the roughly $3 billion frozen, the SAFU and futures fund funding details, and the November 3 full proof date)
• CryptoBriefing, Binance says 90% of hacked funds covered as withdrawal restart nears (published October 31, 2026, secondary source for the 90% figure, the ten tokens fully backed at 100%, the 00:00 UTC October 31 snapshot, the 40 to 50 hour zero-knowledge proof timeline to November 3, the SAFU 2018 establishment and $1 billion restoration commitment, and the November 1 reopening expectation)
• Binance, Security Incident Update #2, October 30, 2026, signed by co-CEOs Yi He and Richard Teng (context source for the prior about 80% figure, the more than $6.34 billion reserve, the market and over-the-counter buyback of remaining tokens, and the original phased withdrawal and proof of reserves timetable)