Binance Restarts Withdrawals as Hack Replacement Climbs Toward Full Cover

By Coinvote

Published November 1, 2026 - 07:23 UTC | 4 mins read

Binance says it has replaced most of the assets lost in its $6.3 billion hack and has begun reopening withdrawals, starting with Bitcoin. Independent verification remains pending, with a full cryptographic proof still being generated and a reserves publication planned for Monday.

Withdrawals return first for Bitcoin

Binance has started to reopen customer withdrawals, beginning with Bitcoin, following the $6.3 billion theft, The Defiant reported on Sunday. The exchange told the outlet it had restored about 95% of the affected amount, with less-liquid tokens making up the remaining 5%.

The restart follows a target the exchange set a day earlier. Cointelegraph reported that Binance said on Saturday it was on track to resume withdrawals on Sunday. CoinDesk also reported the Sunday goal, alongside a plan to publish a proof of reserves on Monday.

Cointelegraph described the theft as the largest cryptocurrency hack on record. It added that TRM Labs has since attributed the attack to TraderTraitor, a hacking group linked to North Korea.

Treasury, SAFU and insurance money cover the loss

A Binance spokesperson told Cointelegraph that the replacement is paid from the company's own treasury, together with money drawn from the SAFU emergency fund and from the exchange's futures insurance reserve. In the spokesperson's words, “Binance will absorb the financial impact of the stolen funds, not users.” The spokesperson added that the insurance fund would stay above required risk management levels.

The statement left gaps. Cointelegraph noted that the spokesperson gave no breakdown of what each pool contributed, no minimum balance for the insurance fund and no figure for the amount of stolen crypto that has been retrieved.

A SAFU-type fund is an emergency reserve that an exchange holds to compensate users after a loss. The Defiant separately reported that Binance confirmed a transfer of 7,499 BTC from SAFU after the hack. The exchange also pledged to rebuild the emergency fund to about $1 billion, the outlet said.

The figures reported so far

The numbers below come from the outlets' accounts, and several of them are Binance's own claims that have not been independently confirmed.

Size of the hack: $6.3 billion, according to Cointelegraph, The Defiant and CoinDesk.
Amount set aside: $6.34 billion, including $5 billion in the affected cryptocurrencies, as Binance said on Friday.
Replacement progress: 80% on Friday, 90% on Saturday and about 95% in The Defiant's Sunday report.
Frozen by partners: about $3 billion, locked by industry partners such as Tether and Circle, which Cointelegraph said is separate from Binance's own replacement of stolen tokens.
Fully backed balances: Bitcoin, Ether and eight other assets, according to Binance's update on X.
SAFU target: about $1 billion, the level Binance says it will rebuild the fund to.

Where the outlets' accounts agree and differ

The most visible gap is the replacement percentage. Cointelegraph reported 90% on Saturday, and The Defiant's earlier piece on the SAFU transfer carried the same figure. The Defiant's later report moved to about 95%. The outlets do not give timestamps for each claim, but the sequence is consistent with Binance still buying tokens as it went.

The outlets also emphasise different things. Cointelegraph supplies the funding sources and the verification doubts. The Defiant focuses on the withdrawal restart and the SAFU transfer. CoinDesk adds a security angle: its summary says CEO Richard Teng stated that the hackers erased evidence and bypassed security checks, and its headline describes a wider breach.

CoinDesk's account is available only in headline and summary form. Details of what the wider breach involved, or how it relates to the theft itself, are not established in the outlets' accounts.

Why independent verification matters

Cointelegraph reported that CertiK said on Friday it needed more information to verify the claimed $5 billion in replacement cryptocurrencies. Binance has since published an updated reserves disclosure. It says the full zero-knowledge proof is still being generated and takes roughly 40 to 50 hours because of the computational workload.

A proof of reserves is meant to show that an exchange's holdings cover its customer balances. A zero-knowledge version lets the exchange demonstrate this without exposing individual account data. Until it is published and checked, the claim that balances are fully backed rests on the exchange's word and its own disclosures.

That gap is why the Monday publication, reported by CoinDesk, is the next real test. It will show whether outside reviewers can confirm what Binance has said about its replacement assets.

What to watch next

Several questions remain open. One is whether the Monday proof of reserves matches Binance's claim that Bitcoin, Ether and eight other assets are fully backed. Another is how quickly the exchange can close the remaining shortfall in less-liquid tokens, which it is buying through market and over-the-counter trades.

Users can check which assets are open for withdrawal, since The Defiant reports the restart began with Bitcoin. They can also look at the published reserves documents once they appear. Project teams with tokens listed on the exchange may want to follow the less-liquid token purchases, although the outlets do not say which tokens are involved.

Two further points are unresolved. The first is the exact split between treasury, SAFU and insurance fund money. The second is what the wider breach described by CoinDesk means for the exchange's security practices.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$77,836	+0.6%	-3.2%	$1.56 trillion
Ethereum (ETH)	$2,265	+0.9%	-3.5%	$276.72 billion

CoinGecko data as of 2026-11-01 (UTC).

FAQ

Has Binance reopened withdrawals after the hack?

According to The Defiant, Binance has begun reopening withdrawals, starting with Bitcoin. Cointelegraph and CoinDesk had earlier reported a Sunday target for the restart.

How much of the stolen money has Binance replaced?

Cointelegraph reported 90% on Saturday, up from 80% on Friday. The Defiant later reported about 95%, with less-liquid tokens making up the rest. These are Binance's own claims, and CertiK told Cointelegraph it needed more information to verify the replacement assets.

Are users bearing the loss from the Binance hack?

A Binance spokesperson told Cointelegraph that the exchange, not users, will bear the cost, drawing on company treasury money, SAFU resources and its futures insurance reserve. The exchange has not disclosed how much each source contributed.