Binance has set aside more than $6.34 billion to absorb the largest crypto theft on record, and it has already parked $5 billion of that reserve in the exact tokens the attacker drained. The figures, published late Friday in the exchange’s Security Incident Update #2, mean the exchange has pre-funded roughly 100.6% of the $6.3 billion it estimates left its hot wallets on October 29.
The details matter more than the top line. Binance is not writing a check and walking away. About 80% of the liability is already covered in kind, with $5 billion held in USDC, USDT, BTC, ETH, BNB and the other assets that were taken. The rest is being bought through market and over-the-counter channels — a roughly $1.3 billion shopping list spread across the same tokens that just sold off. That is a flow story traders will be watching for days.
The $6.34 Billion Cushion, Broken Down
Binance’s update is short on narrative and heavy on numbers, which is exactly what a recovering market needs. “We have already set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets that were stolen, such as USDC, USDT, BTC, ETH, BNB, etc.,” the exchange wrote. The $6.34 billion is deliberately larger than the $6.3 billion impact, a cushion of roughly $40 million on top of the loss estimate.
The split is the story. Divide $5 billion by the $6.3 billion impact and the exchange has already covered 79.4% of what was taken, in kind. Binance rounds that to “approximately 80%.” The remaining 20% is the part being acquired in the open market and over the counter, which works out to about $1.3 billion of buying that has not fully hit order books yet.
The reserve itself draws on two pots: the Secure Asset Fund for Users and the corporate treasury. SAFU is the emergency insurance fund Binance has maintained since July 2018, built up over years from a slice of trading fees, and it exists precisely for moments like this one. The exchange did not say how the $6.34 billion splits between the two pots, and that omission matters. SAFU is notionally ring-fenced for customers; treasury funds are simply company money. Either way, the message to users is blunt and repeated: “Binance will absorb the financial impact of these stolen funds, not our users.”
A Withdrawal Clock and a Proof-of-Reserves Date
Binance put two timestamps on its recovery that traders can hold it to. Withdrawals, which have been frozen since the evening of October 29, are targeted to restart “within approximately 34 hours” of Friday’s update, on a phased basis and subject to security checks. Deposits and other unaffected services remain operational. The first proof-of-reserves snapshot is scheduled about 12 hours after the update, with results due by Monday, November 2.
Proof of reserves is the part worth reading carefully. A snapshot showing Binance holds $5 billion-plus in the stolen tokens proves one thing: that the assets it says it holds are actually there. It does not prove the exchange’s full liabilities are matched, and it says nothing about whether the security flaw that allowed the breach has been closed. Binance’s own wording keeps that gap visible — the PoR is described as giving users “an updated view of platform asset holdings and the corresponding backing of user balances,” not a security audit.
The relative times resolve to absolute ones that matter for anyone waiting on a transfer. Friday’s update went out at 19:33 UTC. A 34-hour withdrawal target lands around 05:30 UTC on Sunday, November 1, and the 12-hour proof-of-reserves snapshot lands near 07:30 UTC on Saturday, October 31. Binance cautioned that both are targets, not promises, and that the withdrawal restart will roll out in phases rather than all at once. For market makers and arbitrage desks, the gap between “withdrawals start resuming” and “withdrawals are fully back” is where pricing risk sits, because a phased reopening means some assets and chains come back before others.
The exchange also committed to a full post-mortem, with “further technical findings” expected within about 48 hours, once disclosure will not compromise the investigation. That document, not the balance-sheet snapshot, is the one that will tell traders whether the October 29 exploit was a one-off or the symptom of a broader control failure.
The Breach Was Not Just One Laptop
Binance walked back its first theory. The initial account pointed to a compromised laptop belonging to a DevOps engineer. Friday’s update changes that: “our subsequent investigation has uncovered additional points of breach.” The exchange still says it has found “no evidence that wallet private keys were leaked,” which matters because a leaked key would require reissuing wallets, not just rotating infrastructure.
What that leaves is an investigation that is widening rather than closing. Binance said its teams are working with internal and external security experts to reconstruct the full attack sequence, and it is not yet saying who was behind it or how much of the frozen funds will ultimately be recovered. The frozen total — about $3 billion, or 47.6% of the $6.3 billion impact — is the floor on what comes back, not the ceiling. Stablecoin issuers can blacklist and return frozen USDT and USDC, but the portion of the haul parked in Bitcoin and Ether can only be recovered if the attacker is identified, because those chains have no issuer to freeze a wallet.
This is the uncomfortable counter-case to the reassuring headline. Binance has reserved enough to make users whole, but the exchange itself is still out roughly $3.3 billion until law enforcement, stablecoin issuers and other exchanges claw the frozen funds back. Full coverage is a solvency pledge, not a recovery.
What the Buyback Does and Does Not Do
The roughly $1.3 billion in market and OTC purchases is the part of the plan that leaks into price action. Binance is a buyer, not a seller, of BTC, ETH, BNB and the rest. But the size has to be kept in proportion. This is not a fresh $6.3 billion bid arriving at once. Four-fifths of the liability is already sitting in the reserve, so only the remaining fifth represents new demand, and OTC desks can absorb that without printing a visible candle.
For BNB, the token at the center of the incident, the buyback is a small tailwind layered on top of a still-open story. The exchange’s native token sold off harder than the majors when the hack landed, and it will now trade with a buyer in the background that has a reason to keep purchases steady rather than splashy. The next signals are concrete: the withdrawal restart, the Monday proof-of-reserves result, and the post-mortem. Each one either validates Binance’s timeline or reopens the risk that sent Bitcoin to a six-week low as the exchange froze its doors.
Binance co-CEOs Yi He and Richard Teng signed the update themselves, a deliberate show of accountability for a breach that has already forced the exchange to pause its hot-wallet operations and rebuild withdrawal infrastructure from the ground up. The numbers are now public. The exchange has to hit the dates it just published, and the market will be checking the clock.
Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.
