Binance says 90% of hacked funds replenished; withdrawals still set for Sunday

Binance said Saturday morning that it has now covered 90% of the assets lost in the attack, up from about 80% on Friday. It said it remains "on track to reopen withdrawals" on Sunday, Nov. 1 [1]. Within half an hour of the update, 7,500 bitcoin left the public wallet of its emergency user-protection fund, according to two blockchain explorers [3][4]. Users still cannot withdraw. What changed is the scorecard Binance keeps on its own balance sheet.

The update, Binance's third, was posted on binance.com at 10:24 a.m. ET and edited at 11:23 a.m. ET [1]. It follows the Friday-afternoon update in which Binance said it had found "additional points of breach" [2].

The mechanism

Coverage is a number Binance restates. It is not money that moved to users. Binance has said since Friday that it set aside more than $6.34 billion in company funds [2]; Saturday's update describes the money as set aside "to cover hacked losses" [1]. The covered share measures how much of that loss it has rebuilt in the same tokens that were taken, so that every customer balance is matched by an asset again. "That covered amount is now up to 90%," the update says [1].

The covered share rises as Binance buys tokens. The update says it will "continue to buy the remaining relevant token assets through market and OTC channels until the covered amount reaches 100% for all tokens" [1]. OTC means large trades arranged directly between two parties rather than on an exchange's order book. The hard part is the tail. Binance says "the outstanding 10% consists of tokens outside the top ten," which "are less liquid, which means they may take longer to source in the required amounts" [1].

The update names the ten tokens it calls finished: "All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%" [1].

The evidence

Binance says the money came from three places: "a partial deployment of the Secure Asset Fund for Users (SAFU)," "a portion of our Futures insurance fund," and "Binance's own corporate treasury" [1]. SAFU is the emergency reserve Binance set up in July 2018. The futures insurance fund covers losses when leveraged traders' positions go bust. Drawing on it raises a question for futures traders: whether a thinner fund makes auto-deleveraging more likely. That is the forced closing of profitable positions to cover a bankrupt one. Binance's answer is that "what was released was excess above that level," meaning the level its risk framework requires. It says the funds "remain above the coverage level required" and that "the remaining balance of the Futures insurance fund is a regulatory requirement" [1]. Binance says the fund's public balance "refreshes daily at 00:00 (UTC)" [1].

Source: Binance [1][2], in Binance's words.

The SAFU part can be checked on-chain, and Binance publishes the fund's bitcoin address [1]. The update said the SAFU deployment "is expected to happen over the next 24 hours" [1]. Both explorers show it began within the hour.

Source: mempool.space [3], cross-checked on blockchain.info [4]. Net of change returned to the same address; totals are Le Coin's arithmetic.

Both transfers went to the same address, 165EurvYDfNNYFQCtdT6LEPJrCeX3SMmee [3]. Binance has not said what that address is, and we have not identified it. By Le Coin's arithmetic, the move roughly halved the wallet, from about 15,000 bitcoin to 7,500. At CoinGecko's price of $77,512 at 12:04 p.m. ET, the 7,500 bitcoin sent was worth about $581 million [5]. That is our calculation, not a Binance figure.

Binance also says it will refill SAFU afterward, "to return the fund size to approximately US$1 billion" [1]. On the reserves check, it says it took a new Proof of Reserves snapshot "at 2026-10-31 00:00 (UTC)" [1]. That is a point-in-time record of customer balances against the exchange's holdings. The cryptographic proof that lets users check their own balance "takes approximately 40 to 50 hours to generate" [1].

The objection

Every coverage number here is Binance's own. The 90% has no independent count behind it, and the update does not give a dollar amount for the remaining 10% or list the less-liquid tokens. The SAFU transfer shows bitcoin leaving a known wallet. It does not show where the coins ended up or what they paid for. Binance's FAQ says the fund is being used "to acquire the remaining 10% of outstanding assets," even though bitcoin itself is already 100% covered [1].

The reserves proof has also slipped. On Friday, Binance said the result would be "ready by Monday 2026-11-02" [2]. Saturday's estimate is Tuesday, Nov. 3, in UTC [1]. That is a day later, and after withdrawals are due to reopen.

The tell (Le Coin's view)

In Le Coin's view, Sunday's reopening is the test that matters more than the coverage number. A phased reopening that holds would show the backing is real. A delay, or a reopening that excludes the less-liquid tokens, would show that the last 10% is the binding constraint. Watch the SAFU address too. If it is refilled toward Binance's stated $1 billion target, that is a commitment anyone can check.

Stop

Binance says 90% of the attack's losses are now covered and withdrawals remain on track for Sunday, Nov. 1. 7,500 bitcoin left its SAFU wallet Saturday morning. The full reserves proof is now estimated for Tuesday, Nov. 3 (UTC).

Sources

• [1] Binance, "Security Incident | Recovery Update #3: 90% of Stolen Assets Replenished; Proof of Reserves Snapshot Provided (2026-10-31)," https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62, published 10:24 a.m. ET Oct. 31, edited 11:23 a.m. ET; accessed 12:05 p.m. ET via Binance's public CMS feed.
• [2] Binance, "Security Incident Update #2 (2026-10-30)," https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751, published 3:33 p.m. ET Oct. 30.
• [3] mempool.space, address 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD, https://mempool.space/address/1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD, accessed 12:05 p.m. ET Oct. 31.
• [4] Blockchain.com explorer, same address, https://www.blockchain.com/explorer/addresses/btc/1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD, accessed 12:05 p.m. ET Oct. 31.
• [5] CoinGecko, bitcoin price, https://www.coingecko.com/en/coins/bitcoin, $77,512 at 12:04 p.m. ET Oct. 31.
• The wallet's prior balance, the transfer totals and the dollar value are Le Coin's arithmetic.

Holding the Corner.

Not financial advice.