Binance says it has completed replacing the cryptocurrency assets affected by its $6.3 billion security breach in late October, drawing on its emergency user-protection fund, excess futures insurance reserves and corporate treasury to cover the losses.
In a November 13 announcement, the exchange confirmed that it had committed more than $6.34 billion in company-controlled resources to restore affected assets. Replacement tokens were acquired through market purchases and over-the-counter transactions, allowing Binance to complete a replenishment process that began immediately after the October 29 attack.
The funding arrangement leaves a second part of the recovery unfinished. Binance has pledged to restore its Secure Asset Fund for Users (SAFU) to approximately $1 billion, but has not announced when that replenishment will be completed.
A seperate breakdown of those amounts, though, Binance has not provided. The exchange has not disclosed how much it withdrew from SAFU, how much came from its Futures Insurance Fund or the amount ultimately absorbed by its corporate treasury.
Binance draws on three funding sources to replace stolen assets
The November 13 announcement completes a series of recovery milestones following the theft, which affected Binance’s cryptocurrency wallet infrastructure.
By October 31, Binance reported that approximately 90% of the affected assets had been replenished. That figure reached 95% by November 1 and 98% by November 4, when the exchange said it had already reserved sufficient resources to cover the entire loss.
The remaining purchases involved cryptocurrencies with comparatively limited market liquidity. The last 2% was harder, it was the thinner-traded coins. Binance had previously explained that acquiring these tokens in sufficient quantities required additional market and OTC transactions.
Its latest statement confirms that the asset-replacement process has now been completed. A small number of tokens that Binance no longer supports will instead be handled through its delisting procedures, with financial protection promised to affected holders.
Binance’s use of its Futures Insurance Fund introduces an additional consideration for derivatives traders. The fund ordinarily absorbs deficits arising from liquidated futures positions and helps limit the need for automatic deleveraging, which can reduce profitable traders’ positions during extreme market conditions.
According to the exchange, only insurance reserves exceeding the levels required under its risk-management framework were redirected toward covering the hack. Binance previously said the remaining fund balances continued to satisfy its internal stress-testing requirements and that it would replenish them if they fell below required levels.
Those assurances have not been accompanied by a transaction-level accounting of the reallocation. The company has also not disclosed the size of the surplus removed from each affected insurance pool, limiting any independent assessment of how much of its additional protection capacity was used.
SAFU replenishment remains a separate commitment
Binance established SAFU in 2018 as an emergency reserve intended to protect users against exceptional losses, including security incidents. The fund had a target value of approximately $1 billion before the latest breach.
That reserve was considerably smaller than the financial commitment required after the October attack. A fully funded $1 billion SAFU reserve would represent approximately 15.8% of the $6.34 billion committed to replacing affected assets, illustrating why Binance needed to rely on other company-controlled resources.
The exchange has confirmed that part of SAFU was deployed, but has not published the amount used or a timetable for returning the fund to its target. The refill is promised, the deadline is not.
As examined in DaveFinances’ earlier analysis of Binance’s custody arrangements and SAFU protection, the emergency reserve serves a different purpose from the assets held against customer balances. SAFU provides an additional financial backstop rather than a substitute for full customer-asset backing.
Completing the replacement of stolen customer assets therefore does not establish that Binance’s emergency protection funds have also returned to their previous capitalization.
The company has not specified whether the eventual replenishment will come entirely from corporate treasury resources or another funding arrangement. Its latest announcement provides no updated SAFU valuation against the approximately $1 billion target.
New proof of reserves expands coverage to 198 tokens
Alongside the replenishment announcement, Binance published a new Proof of Reserves snapshot taken at 00:00 UTC on November 12.
The snapshot covers 198 cryptocurrencies, a substantial expansion from the 44 tokens included in the November 4 reserve review. It is 198 tokens this time, just 44 on November 4.
The exchange expects the complete zero-knowledge cryptographic proof to take approximately 40 to 50 hours to generate. Based on the snapshot time, that points to a completion window between November 13 and early November 14 UTC, subject to processing requirements.
Once generated, the proof is intended to allow eligible customers to verify that their recorded balances are backed by corresponding reserves at a minimum ratio of 1:1.
The expanded coverage provides a broader view of customer-asset backing, but does not independently establish the financial position of Binance’s corporate treasury or the capitalization of its emergency protection funds.
Binance previously clarified that its Futures Insurance Fund is not included in the customer Proof of Reserves system. Insurance reserves are company-funded protection mechanisms, while the reserve verification process addresses customer asset balances and their corresponding backing.
Consequently, the new snapshot cannot establish how much insurance capacity remains following the transfers used to replenish stolen assets. Nor does a point-in-time cryptographic reserve verification constitute a complete audit of every corporate liability.
US authorities freeze $2.7 billion as withdrawals reopen
The company’s asset-replacement effort is proceeding alongside a separate law-enforcement operation to recover the cryptocurrency stolen during the attack.
On November 12, the US Department of Justice announced that authorities and private-sector partners had frozen more than $2.7 billion in assets connected to the Binance theft.
Of that amount, the department had obtained court authorization to seize or restrain more than $1.2 billion. The FBI attributed the attack to North Korea’s TraderTraitor operation, while investigators continued tracing stolen cryptocurrency through exchanges, bridges and mixing services.
The $1.2 billion subject to court authorization is part of the larger frozen amount, not an additional recovery. Court-authorized restraint also does not establish that the entire amount has been forfeited or returned to Binance.
Similarly, the company’s replacement of customer assets should not be confused with the recovery of cryptocurrency from the attackers. Funds recieved through future recoveries could affect the exchange’s eventual net financial loss, although Binance has not disclosed how it intends to account for any subsequent recoveries.
Withdrawal services are another outstanding element of the operational recovery. Binance began reopening selected cryptocurrency networks on November 1, as detailed in DaveFinances’ report on the initial withdrawal restart.
Some users can withdraw again, just not every asset on every chain.
The November 13 announcement confirms that withdrawals continue to reopen in phases rather than declaring a complete restoration of services. Full withdrawal access is not yet availble across every previously affected asset-network combination.
Regional operations have also experienced prolonged restrictions. As of November 12, Binance Japan still listed 16 cryptocurrencies as unavailable for withdrawal, despite restoring additional assets, according to DaveFinances’ latest coverage of Binance Japan’s service recovery.
Binance has now declared its customer-asset replacement program complete, while three related processes remain at different stages: restoring SAFU to approximately $1 billion, independently verifying the expanded reserve snapshot and fully reopening cryptocurrency withdrawals. The exchange has provided no combined timetable for completing those remaining commitments.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.