Binance Covers an Estimated 95% of Stolen Assets, Starts Reopening Withdrawals in Phases

By The Edge Research Team

First published on 30 October at 18:56 GMT; updated on 31 October at 18:01 GMT with the company’s updates of 30 and 31 October, and on 1 November at 10:06 GMT with its update of 1 November.

Binance began reopening customer withdrawals in phases on Sunday and said it had covered an estimated 95% of the assets stolen in its security incident, up from 90%.

For customers the reopening is gradual: the first phase lists 15 networks and their main tokens, chosen on the past week’s user demand, with more to follow once they are ready. The company says it, not its users, will bear the cost, and the outstanding 5% is in less liquid tokens outside its top 10.

The exchange’s regulator in Abu Dhabi has also responded. Abu Dhabi Global Market’s Financial Services Regulatory Authority (FSRA) said on 30 October that it is engaging closely with the exchange and monitoring the incident, which it described as involving unauthorized withdrawals of assets. The regulator said protecting the interests of clients and supporting the integrity and orderly functioning of markets remain its key priorities.

The First Phase Lists 15 Networks for Withdrawals

The company’s fourth recovery update was published at 04:08 GMT on Sunday. It set the first phase of withdrawals for between 06:00 and 09:00 GMT the same day, and said deposit services remain open and were not affected by the incident.

The phase covers 15 networks, from Bitcoin and Ethereum to Solana, TON and Sui, with 33 network and token pairs in all. The company says it ranked tokens on the past week’s user demand so that each pair is restored only after stability and security checks; further networks and tokens will be added once they are ready.

It warns that withdrawals may be delayed or take longer to process during the first rollout because of traffic, and that a withdrawal on a listed network that does not go through can be tried again after a short while. It says it will post further updates on its official X channel.

By 10:02 GMT, the company’s deposit and withdrawal status page showed withdrawals open on 7 of the 15 networks for every token listed on each: Bitcoin, Ethereum, BNB Smart Chain, XRP, Dogecoin, Base and Optimism. The other 8, including Solana, Tron and TON, still showed withdrawals suspended.

Networks in the first phase of withdrawals

Networks and tokens as listed in the company’s fourth recovery update of 1 November; withdrawal status from its deposit and withdrawal status page at 10:02 GMT on 1 November. Yes means withdrawals were open for every listed token on that network.

The Company Raises Its Estimated Covered Share to 95%

The company’s second update came at 19:33 GMT on 30 October. It said more than $6.34bn of company funds had been set aside to cover the losses, $5bn of it in the same tokens that were stolen, such as USDC, USDT, bitcoin, ether and BNB.

On that basis it put the share of the impacted amount already covered at an estimated 80%. The third update, published at 14:24 GMT on Saturday, raised that share to 90%. The fourth, on Sunday, put it at an estimated 95%.

All of the top 10 tokens on its list are now fully backed, the company says: bitcoin, ether, USDT, BNB, solana, USDC, XRP, USD1, RLUSD and ZEC. It is still buying the remaining tokens through market and over-the-counter channels until every token reaches 100%; the outstanding 5% are less liquid and take longer to source at the scale required, it says.

Three sources paid for the replenishment: a partial deployment of SAFU, the Secure Asset Fund for Users, which the third update said would run over the following 24 hours; a portion of the Futures insurance fund; and the corporate treasury. The company says the insurance fund’s remaining balance is a regulatory requirement, and that what it released was the excess above the level its risk framework requires.

SAFU is the emergency fund the exchange set up in July 2018 for cases such as security breaches. It is managed by Nest Clearing and Custody Limited, a recognized clearing house regulated by the FSRA, and part of it serves as capital reserves under the company’s regulatory obligations in ADGM. The company has committed to refilling the fund to what it describes as approximately $1bn.

Investigation Uncovers Additional Points of Breach

The second update puts the compromise of the company’s hot wallets at around 20:05 GMT on 29 October. It estimated the loss at $6.3bn of token assets, the same figure as the first notice.

That first notice, published at 02:23 GMT on 30 October, said the initial investigation suggested the incident may have involved a compromised laptop belonging to a DevOps engineer, which allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. The second update added that later investigation has uncovered additional points of breach.

As of the second update, the company had found no evidence that wallet private keys, the secret keys that authorize spending from its wallets, were leaked. It says it will share further technical findings once they are verified, followed by a detailed technical report on what happened and the safeguards being added. The fourth update says a post-incident report will follow once the investigation is complete.

Withdrawals were suspended as a precaution while the company contained the loss, assessed its impact and completed security checks, the fourth update says; deposits stayed open throughout, and the second update said other unaffected services kept operating. On customer money the first notice was direct: “User funds are safe.”

The second update put the amount frozen on-chain to date at an estimated $3bn, with further recovery efforts to follow. The freeze and the covered share are separate measures on the updates’ own account: the freeze is recovery still under way, while the replenishment draws on SAFU, the insurance fund and the treasury.

The company says it is working with law enforcement, blockchain intelligence firms and token issuers to trace and recover the stolen funds and to identify those responsible.

New Snapshot Shows All 10 Tokens Covered, With Thinner Margins

The new Proof of Reserves snapshot was taken at 00:00 GMT on 31 October, before the third update, and is already on the company’s reserves page. It covers 10 assets, against 55 a month earlier. The page marks its Merkle root hash, the cryptographic seal over customer balances, as still in progress.

The ratios are the company’s own figures and describe holdings at the moment of the snapshot only; the full zero-knowledge proof, expected by 3 November, will let holders of the 10 tokens check that their own assets are backed. Every one of the 10 shows reserves of at least 100% of net account balances. Against 1 October, margins are thinner for 6 of them, unchanged for ether and solana, and wider for BNB and XRP.

The largest drop in cover is in USDT, whose ratio fell to 100.00% from 103.88%. On-chain USDT now exceeds net account balances by just 6 tokens, against a surplus of 1.24 billion tokens a month earlier. Ether and solana cushions are under 3 tokens each.

Bitcoin cover eased to 100.04% from 100.35%. That leaves 302 BTC in the reserve addresses beyond net account balances, down from 2,431 BTC at the start of the month. USDC remains the best-covered asset at 106.08%, down from 108.26%.

Reserve ratios on the Proof of Reserves page (in %)

On-chain wallet balance as a share of net account balances, which since January 2026 include the platform’s own assets; snapshots at 00:00 GMT on each date. The 31 October snapshot covers 10 assets; the 1 October snapshot covered 55.

Net account balances moved both ways over the month. USDT net account balances fell 7.9% to 29.48 billion tokens.

Bitcoin balances edged up 0.5% to 692,187 BTC. Ether balances fell 3.8% to 3.65 million ETH.

Net account balances (in millions of tokens)

Snapshots at 00:00 GMT; balances in each token’s own units, as published, with values above 1,000 rounded to the nearest million. Bitcoin and ether balances are given in the text.

The page gives no reason for these changes, and the snapshot predates both the third update and the reopening of withdrawals.

The page carries its own caveat: the excess assets in the reserve addresses are not indicative of the overall amount of the company’s own assets. It also states that the company has zero debt in its capital structure and keeps the SAFU fund for extreme cases such as hacks or security breaches.

Generating the full zero-knowledge proof takes an estimated 40 to 50 hours, the company says. It expects the proof by Tuesday, 3 November, after which customers with any of the 10 tokens can check that their assets are backed at least one for one. Its second update had aimed to have the snapshot’s result ready by Monday, 2 November.

In The Edge’s reading, the company’s own figures for the 31 October snapshot show the pledge met at the line rather than with room to spare, since the USDT and bitcoin surpluses have shrunk to a fraction of their 1 October size. The outstanding 5% is in tokens outside the 10 that the snapshot covers.

What to watch: Tuesday, 3 November, the estimated completion of the full zero-knowledge proof for the 31 October snapshot.

Correction, 31 October 2026: an earlier version compared reserve ratios, account balances and surpluses with October 2025 without noting that Binance changed the scope of its Proof of Reserves account balances in January 2026; those comparisons have been removed.

Figures are from Binance’s Security Incident Update and Security Incident Update #2 (30 October 2026), its Recovery Update #3 (31 October 2026), its Recovery Update #4 and its deposit and withdrawal status page (1 November 2026) and its Proof of Reserves snapshots of 1 October 2026 and 31 October 2026, and from the Financial Services Regulatory Authority’s statement of 30 October 2026; point changes, surpluses, percentage changes and asset, network and pair counts not attributed to a source are The Edge’s calculations, in each token’s own units.

Sources: Binance, Financial Services Regulatory Authority, The Edge.

Get Complimentary Insights

Follow us