Binance said on Tuesday, November 4 that it has replenished roughly 98% of the assets stolen in the security incident it disclosed at the end of October, the closest the exchange has come to closing the book on a breach that froze an estimated $6.3 billion in customer funds. The update, published in Binance’s seventh recovery update, landed alongside a new proof-of-reserves snapshot that quadruples the number of tokens the exchange commits to proving at least one-to-one backed.
The two figures frame the same event from different angles. Ninety-eight percent is the solvency number, the share of the impacted amount Binance has restored using its own resources. Forty-four is the transparency number, the count of tokens in the November 4 snapshot, up from ten in the snapshot taken October 31. Together they mark the point where the recovery stops being a question of whether the money is there and becomes a question of how fast the final, less-liquid slice can be sourced.
98% of $6.3 Billion, in Dollar Terms
Binance’s own accounting puts the “estimated total impact” of the incident “at around $6.3B,” a figure it first published on October 30 in its initial security incident update. That same notice said roughly “$3 billion” had already been frozen on-chain with the help of blockchain partners, about 47.6% of the total locked in place within days.
Applying the 98% figure to the $6.3 billion estimate puts the restored amount at about $6.17 billion, leaving a residual of roughly $126 million, or 2%. The arithmetic is straightforward; the source of the replenishment is what matters. Binance said it had “already set aside more than 100% of the funds needed to cover these losses” from its own resources, a phrase that spans the Secure Asset Fund for Users (SAFU) and company funds rather than customer balances. “We have now replenished approximately 98% of the impacted amount, and we continue to buy the remaining token assets through market and OTC channels,” the exchange wrote.
The SAFU reference is worth unpacking because it is the mechanism that lets Binance make the promise stick without touching user funds. SAFU is the exchange’s emergency insurance fund, built up since 2018 from a slice of trading fees and held in a mix of bitcoin, ether, and stablecoins. On October 30 Binance committed that it would “cover all losses from the SAFU fund and the company’s funds,” and the 98% figure is the running total of that commitment being executed, not a promise waiting on a future cash injection.
The Last 2% Is the Slow Part
The final slice is slow for a reason Binance states plainly. “Purchases for the remaining 2% are expected to be slower because these tokens are less liquid,” the update said. That is a liquidity statement, not a solvency statement: the tokens left to repurchase are the long tail of the stolen basket, assets thin enough that buying back roughly $126 million of them without moving their own prices has to be spread across market and over-the-counter desks.
The distinction tracks the whole recovery arc. Binance reported about 90% of stolen assets replenished by October 31, and the exchange has climbed toward 98% in the four days since. Each percentage point against a $6.3 billion base is about $63 million, so the step from 90% to 98% is itself a roughly $504 million repurchase. The campaign that set up the theft took months — Binance has said attackers spent six months infiltrating its systems — and the recovery is now being measured in single-digit percentage increments.
The illiquidity point also explains why the final stretch has no date attached. Binance can buy back bitcoin or ether at scale without meaningfully moving the market, but a thin altcoin can gap against any large bid. Spreading those buys across OTC desks and market hours is the difference between restoring a balance and driving up the price it has to pay to do so, which is why the exchange has promised further updates rather than a completion deadline.
Proof of Reserves: From 10 to 44 Tokens
The transparency side of the update is a second, quieter milestone. The new snapshot, taken at 00:00 UTC on November 4, “now covers 44 tokens, up from 10 in the previous snapshot.” That is a 4.4-times expansion of the assets Binance lets users verify themselves, moving the reserve proof beyond the ten major coins — bitcoin, ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD, and Zcash — that the earlier zero-knowledge proof covered.
Verification is not instantaneous. “Generating the full zero-knowledge proof is expected to take approximately 50 to 60 hours due to the computational workload,” Binance wrote, and only once it lands can “users holding any of the covered tokens … independently verify that their balances are at least 1:1 backed.” The 50-to-60-hour window is itself a step up from the “approximately 40 to 50 hours” the exchange quoted for the ten-token proof, a reflection of the larger Merkle tree the wider snapshot has to wrap.
What the Update Still Does Not Prove
Two things remain open even at 98%. The first is the technical post-mortem. Binance’s initial notice attributed the breach to a compromised DevOps engineer’s laptop that let an attacker reach a service container and submit unauthorized withdrawals, but the exchange has said a detailed report will follow only “once the investigation is complete and the facts are fully verified.” The solvency side of the story is nearly closed; the security side is not.
The second is the residual itself. A proof of reserves is a point-in-time inventory, proof that a dated snapshot is covered, not that every future day stays one-to-one. And the final 2% is exactly the portion that is hardest to source quickly, which is why Binance has offered no completion date, only a pledge to “continue to provide further updates.”
For a compliance desk or a fund administrator, the reserve proof is the more important of the two developments. A 1:1 zero-knowledge proof across 44 tokens turns a solvency claim into arithmetic a third party can recompute, which is a different evidentiary standard than a company statement. For the retail user, the practical read is simpler: withdrawals have been reopening in phases across more than a hundred asset-and-network pairs since November 1, and the reserve proof is expanding to cover far more of the long tail — but the last sliver of illiquid tokens, and the forensic account of how the money left in the first place, are still outstanding.
