Binance says 98% of hacked assets are replaced as withdrawals reopen in phases and $6B flows out

A week after the $6.3 billion breach, Binance reports about 98% of affected assets replenished from its own balance sheet, a proof-of-reserves snapshot expanded to 44 tokens, and more than $6 billion in outflows in the first 24 hours after withdrawals resumed on November 1.

EV

Elena Varga · Crypto Markets Journalist

Published November 6, 2026 · 6 min read

One week after the largest theft in crypto history, Binance is trying to prove it is still standing. The exchange says it has now replenished roughly 98% of the assets drained in the October 29 breach, has reopened withdrawals in stages since November 1, and has widened its proof-of-reserves snapshot from 10 tokens to 44. The numbers come with caveats — and with more than $6 billion in outflows in the first day of reopened withdrawals.

From 90% to 98% in five days

The recovery narrative has moved fast. Co-CEO Richard Teng put the replenished share at 90% on October 31; by November 1 the exchange said about 95% of affected assets were back, with the remainder mostly illiquid tokens that take longer to buy, according to CoinDesk. By November 4 the figure had reached about 98%, with purchases of the less liquid tokens still under way, per The Crypto Basic.

Founder Changpeng Zhao said on November 2 that Binance did not borrow, sell assets or raise money to cover the more than $6 billion hole — it was covered from the balance sheet, per CoinDesk. 24/7 Wall St. notes that the exchange has not disclosed which assets funded the replacements, how costs were split between the SAFU insurance fund (set up in 2018) and corporate funds, or whether any BNB was sold. Binance is privately held and does not publish earnings.

Withdrawals: 45 hours dark, then a rush for the exit

Withdrawals were suspended for roughly 45 hours after the attack. Restoration began at 06:00 UTC on Sunday, November 1, and by 12:36 UTC all 15 networks and assets in the first phase — including BTC, ETH, SOL, XRP and the major stablecoins — were live, CoinDesk reported. Further assets have been reopened in later phases.

The first day was intense. Binance’s own figures for the first 9.5 hours showed $4.649 billion withdrawn against $1.01 billion deposited — a net outflow of $3.64 billion, or about 2.1% of the $171 billion in assets the exchange reported before the attack. Over the full 24 hours, DefiLlama tracked more than $6 billion leaving Binance-associated wallets, roughly 3.6% of pre-attack holdings, though CoinDesk cautions that wallet-level data can include transfers between addresses the exchange itself controls. Rivals saw inflows over the same window — about $450 million net to OKX and $134 million to Bybit — but the data cannot show how much came directly from Binance customers. Demand for withdrawals surged at reopening and then eased, while deposits remained substantial.

Proof of reserves — almost

The November 4 proof-of-reserves snapshot covers 44 tokens, up from 10, per The Crypto Basic. But users could not yet verify it: Binance said generating the accompanying zero-knowledge cryptographic proof would take another 50 to 60 hours. Until that proof is published, the expanded snapshot is a statement, not an audit — a distinction worth keeping in mind when evaluating any exchange, as our guide to fees, withdrawals and security explains.

Frozen funds and the attacker’s trail

Stablecoin issuers moved within hours of the breach. Crypto Briefing reported on October 29 that Tether froze about $971 million in USDT and Circle around $823 million in USDC linked to the outflows — close to $1.8 billion combined. On the attacker’s side, an address identified by the US Secret Service and analytics firms held about 970,000 SOL after the exploit; roughly half was moved and swapped into bitcoin on November 1, per CoinDesk.

Binance has also been cutting third-party exposure. On November 5 it removed all API keys tied to the trading-tools provider SignalPlus, and Coinbase-owned Deribit revoked the same keys, 24/7 Wall St. reported; Binance said its own systems were unaffected and Zhao urged users to apply the same caution to every external tool they connect. Post-hack periods are also prime time for impersonation and “compensation” scams — our guide on how to spot a crypto scam covers the warning signs.

Market and competitor reaction

BNB was trading around $705 on November 5, roughly flat on the day and down about 4% on the week, and 48.5% below its October 2025 all-time high of $1,370, per 24/7 Wall St. Coinbase, for its part, used a November 4 security update to stress that more than 99% of customer assets sit in cold storage and that the Binance incident did not touch its platform. The equity market has been less forgiving: Morgan Stanley downgraded Coinbase to underweight on November 2 and cut its target to $120 from $258, CoinDesk noted, as crypto stocks sold off broadly.

The original attack, the compromised engineer laptop and the early response are covered in our report on the $6.3 billion Binance hack. If the episode has you reconsidering where to hold assets, start with our ranking of the best crypto exchanges.

The bottom line

Binance has done what few exchanges could — absorb a $6.3 billion loss from its own balance sheet and keep paying withdrawals — and the 98% replenishment and 44-token snapshot are real progress. But the cryptographic proof is still pending, the funding of the recovery is undisclosed, and $6 billion walked out the door in a day. For users, the practical lesson is unchanged: keep only what you trade on any exchange, verify reserves when proofs are published rather than announced, and treat every post-hack message as a potential scam until proven otherwise.

News summary based on the reporting cited above, current as of November 6, 2026. Replenishment percentages and outflow figures reflect Binance statements and third-party on-chain trackers as relayed by those outlets and may be revised; verify against Binance’s official notices. For general information only; not financial advice.