Binance says it covered $6.34 billion hack; verification pending
Binance says it has filled the $6.34 billion hole, but customers are still waiting for proof.
Binance announced on November 12, 2026, that it had finished replacing the $6.34 billion worth of crypto stolen in the October 29 attack, using its own funds. It published a new reserves snapshot covering 198 tokens. According to the available announcements, however, the mathematical proof needed to verify it was still pending, and withdrawals were still being restored gradually.
How did Binance cover the $6.34 billion?
Binance bought the affected tokens on the market and through over-the-counter (OTC) trades—private deals conducted outside public order books. According to Bitcoin Magazine, it spent more than $6.34 billion on the process.
The money came from its corporate treasury, part of its Secure Asset Fund for Users (SAFU) protection reserve, and its futures insurance fund. For the latter, the company said it used funds above the level required under its risk management framework.
It also pledged to restore SAFU to around $1 billion. For a small number of affected tokens it no longer trades, Binance said holders would be compensated through its delisting process.
Replenishing customer balances does not mean the stolen crypto has been recovered.
What does the new reserves snapshot prove?
The new snapshot provides a broader picture of reserves, but users' ability to verify them remains the critical outstanding step. Taken on November 12 at 00:00 UTC, it covers 198 tokens, compared with just 10 in the October 31 snapshot.
Proof of reserves shows the assets the exchange says it holds against customer balances. The accompanying zero-knowledge proof is a mathematical check that, according to the announcement, will allow users to verify backing of at least 1:1: one coin in reserves for every coin owed to them.
Binance estimated that generating this proof would take 40 to 50 hours because of the computational workload. In the available reports, the process had not been completed. Full backing therefore remained a company statement, not a claim customers could already verify.
Have the stolen funds been recovered?
The announcement that the losses had been covered does not specify how much of the stolen assets had been returned to Binance. According to Chainalysis, as reported by BeInCrypto, around $2.8 billion had been frozen by November 3. Freezing assets, however, is not the same as recovering them.
The attack, the largest recorded crypto theft according to the sources, began with a fake job interview and a booby-trapped developer tool. TRM Labs linked the operation to the North Korean group TraderTraitor, while reports say the FBI also attributed the attack to North Korea.
What are we watching on withdrawals and security?
If you are a Binance customer, including in Greece, the practical issues are reserve verification and withdrawal availability. Withdrawals began to resume on November 1, starting with Bitcoin, but the announcement of full backing did not mean withdrawals had reopened across all networks at once.
We view the replenishment with corporate funds as a positive step, provided it is confirmed as announced. But we do not treat covering balances, recovering stolen assets and fully restoring operations as the same thing. Publishing the proof and fully restoring withdrawals are the next concrete tests for the company.