What can we learn from the Binance hack and recovery?

Binance has begun restoring access after a $6.3 billion theft, drawing on its own reserves to replace customer assets. Its recovery offers lessons about how exchanges approve transactions, communicate during a crisis and demonstrate that customers can get their money back.

Summary

• Binance put the October 29 hot-wallet theft at approximately $6.3 billion.
• The exchange reported 95% asset replacement before expanding withdrawals on November 3.
• Binance’s November 2 reserve verification covered 10 cryptocurrencies using an October 31 snapshot.
• Approximately $3 billion had been frozen by October 30, according to Binance.
• A further reserve snapshot covering more tokens was scheduled for November 4.

Binance has expanded withdrawals after reporting that it had replaced approximately 95% of the assets affected by its $6.3 billion October 29 hack.

Binance’s November 3 announcement scheduled another withdrawal phase from 04:00 UTC, with individual assets becoming available after security and readiness checks. Deposits remained open, and the exchange repeated its commitment to absorb the financial loss.

Customers have therefore faced two different recovery processes. Binance has been sourcing replacement cryptocurrency to back their balances, while investigators and industry partners have been trying to recover the assets taken by the attacker.

Returning withdrawal access involves a third task: establishing that the systems which send those assets can operate safely. An account balance, a reserve snapshot and a completed withdrawal each answer a different question about the exchange’s condition.

BREAKING: Lazarus Group’s crypto thefts reach $11.87B, equivalent to 45% of North Korea’s GDP

The estimate from Darkfost includes the $6.3B Binance hack, highlighting the scale of crypto-related theft attributed to the North Korean group. pic.twitter.com/UYXsawtOoC

— crypto.news (@cryptodotnews) November 2, 2026

The Binance hack reached beyond one employee’s laptop

Binance initially suggested a compromised engineer’s laptop might have provided the entry point. By its October 30 incident update, the company said investigators had found additional breach points, while reporting no evidence at that stage that wallet private keys had leaked.

Its published account placed the hot-wallet compromise at approximately 20:05 UTC on October 29. The exchange said it had contained affected infrastructure, revoked authorisations and introduced further controls while investigators worked to establish the sequence of events.

The distinction between stealing a key and obtaining permission to use a signing system is central to the investigation. A transaction can carry a cryptographically valid signature even when the business never intended to authorise the transfer.

TRM Labs’ on-chain investigation traced transfers across 10 blockchains and valued the assets at approximately $6.36 billion when they were taken. Its researchers assessed that the cross-chain activity pointed to a compromise of Binance’s hot-wallet signing infrastructure.

Ethereum activity involved 50 advance authorisations and a contract that could sweep assets from a Binance wallet, according to TRM. Other chains showed ordinary signed transfers, so an explanation limited to Ethereum’s wallet features would leave part of the theft unexplained.

The lesson is about the authority surrounding a signing key as much as the key’s storage. A business must decide which systems may request signatures, which requests need separate approval and how unusual transfers are stopped before they reach a blockchain.

NIST’s zero-trust architecture treats access as something that must be authenticated and authorised for the resource involved. Being inside a company network or using a company-owned device does not establish trust by itself.

Applied to an exchange, that principle separates an engineer’s routine access from the authority to move customer assets. An employee may need to maintain infrastructure without needing unrestricted access to withdrawal instructions, production credentials or transaction approvals.

Binance’s full technical report will need to explain how those boundaries operated during the attack. The evidence published so far supports questions about the signing process, but it does not establish a complete map of the company’s internal controls.

The FBI attributed the theft to North Korea’s TraderTraitor activity on October 31 and said stolen assets were being converted primarily into ether. North Korea denied involvement, according to Associated Press reporting on November 3.

The bureau asked exchanges, DeFi services, infrastructure operators and other firms to block transactions linked to the identified laundering addresses. Its request addressed the movement of stolen assets after the breach, separately from Binance’s investigation into the initial access.

How Binance handled the crisis and recovery

Binance’s response combined restrictions on withdrawals, replacement purchases, cooperation on asset freezes and a sequence of public recovery notices. Each measure addressed a different immediate problem, and the chronology allows customers to compare announcements with subsequent actions.

As crypto.news previously reported, Binance reserved company resources exceeding $6.34 billion and said approximately $5 billion was already held in matching cryptocurrencies by October 30. It targeted a phased withdrawal restart, subject to security checks.

Matching the assets was part of that commitment. Customers holding a particular token were owed that token, while the dollar value of the exchange’s available resources was only an intermediate measure of its ability to purchase replacements.

The October 31 replenishment notice put coverage at 90%. Binance named SAFU, part of its futures insurance fund and its corporate treasury as the funding sources.

It said the 10 identified major assets were fully backed, while less liquid tokens outside that group took longer to acquire. Purchases were being made through market and over-the-counter channels.

By November 1, Binance reported 95% replacement and reopened Bitcoin withdrawals during the initial recovery phase. The first published schedule covered selected assets across 15 networks, rather than every token listed on the exchange.

Using Binance’s reported incident start and its earliest scheduled November 1 reopening time, the interval was approximately 57 hours and 55 minutes. That calculation measures the time to the beginning of the planned restart, not the duration of restrictions for every customer.

Withdrawal access then expanded through individual network and asset combinations. A token available on one network could still be unavailable on another, so the relevant operational measure was the particular withdrawal route a customer needed.

The November 1 notice said demand recorded during the preceding week influenced the reopening order. It warned that traffic could produce delays and told users to check the status of their chosen asset and network.

Its November 3 expansion followed the same approach. Binance said the listed routes would reopen progressively after checks, with temporary delays still possible during the rollout.

Communicating at that level is more useful to a customer than an exchange-wide declaration that withdrawals have resumed. A customer needs to know whether their asset can leave, through which network and whether a submitted request has completed.

JUST IN: Binance restores Ethereum withdrawals for five stablecoins

The exchange has restored $RLUSD, $USD1, ethereum:0x0000000000085d4780b73119b644ae5ecd22b376, $FDUSD and $XUSD withdrawals, with additional assets and networks set to return in phases after security checks. pic.twitter.com/IyF87smgH9

— crypto.news (@cryptodotnews) November 3, 2026

NIST’s incident-response guidance places detection, response and recovery within an organisation’s continuing risk management. Restoring a service is part of incident handling, alongside reducing the chance of another incident and improving the response process.

Binance’s notices provide a record of replacement and reopening milestones. Assessing how effectively it contained the breach requires the technical timeline as well, including when unauthorised access was detected, which permissions were disabled and how restored systems were validated.

Replacing assets and recovering stolen funds are different accounts

A freeze and a replacement purchase can both protect customers, but they do not belong in a single recovery total without further explanation. One restricts the attacker’s access to an asset; the other supplies an asset to meet a customer liability.

Consider a simplified exchange with 100 tokens owed to customers after 100 tokens are stolen. If the exchange purchases 100 replacements, it can restore customer backing even if investigators have not returned any of the original tokens.

Suppose 40 of the stolen tokens are then frozen. Customer backing remains 100 tokens; it does not become 140. The frozen 40 represent a possible recovery for whichever party is ultimately entitled to receive them.

If those 40 are lawfully returned to the exchange after customers have already been made whole, they can offset part of the exchange’s loss. The same tokens cannot simultaneously be counted as replacement assets and an additional customer reimbursement.

Binance said approximately $3 billion had been frozen by October 30 through work with law enforcement, issuers and other partners. Its asset replacement programme proceeded separately, using company resources to buy the missing cryptocurrency.

The figures have different dates, valuation assumptions and purposes. The reported frozen total should therefore be described as an amount immobilised at the stated point, while replacement progress describes the exchange’s work to restore backing.

Applying 95% to the rounded $6.3 billion incident estimate produces $5.985 billion, leaving $315 million at that valuation. This is illustrative arithmetic, not a disclosure of the exact outstanding purchase bill or a token-by-token shortage.

Prices move after a theft, and the quantity owed in each token does not automatically change with its dollar price. A remaining token basket worth $315 million at one valuation could cost a different amount to acquire later.

Liquidity introduces another difference. A token can have a quoted market price without enough offers being available near that price to replace a large holding immediately.

Purchasing through an OTC desk can source blocks from holders outside a public order book. It still requires willing sellers and agreement on quantities, settlement and price; the existence of a budget does not place the required tokens in a withdrawal wallet.

Binance’s explanation that the last portion took longer to source should be evaluated against its subsequent token coverage and withdrawal updates. The meaningful completion point is full matching backing and operational access for the affected assets, rather than a rounded dollar commitment alone.

A freeze stops movement before it settles ownership

Stablecoin issuers can sometimes immobilise their tokens through administrative controls. The same mechanism is unavailable to an issuer of native bitcoin or ether because those assets do not have a comparable central issuer.

Circle’s USDC terms describe blocklisting and conditions on redemption, including legal restrictions that may prevent it. Holding a token, having it frozen and establishing a right to redeem it are separate steps under those terms.

An address restriction prevents specified transfers; it does not by itself identify the proper recipient of a reimbursement. Ownership evidence, legal process and the arrangements for returning assets can still determine what happens next.

Arbitrum used a different intervention in the Binance incident. Its Security Council’s October 30 notice says 8,425 ETH and 74,559,805.2 ARB were moved into a holding address through a temporary contract upgrade.

The notice expressly reserves further movement to an ArbitrumDAO governance vote. Assets moved out of an attacker-linked address were therefore not automatically transferred to Binance or its customers.

JUST IN: Gate freezes two accounts linked to the Binance hacker after $250K in deposits

The exchange says it identified the accounts following an alert from Lookonchain and has begun due diligence, pledging full cooperation with law enforcement and the ongoing investigation. pic.twitter.com/x9PfwaD2BP

— crypto.news (@cryptodotnews) November 2, 2026

The scope of each intervention needs to remain clear. An issuer’s token blocklist, an exchange’s refusal to credit a deposit and a network-level emergency upgrade act at different points in a transaction’s path.

Timing can affect what is still reachable. If a restricted token has already been exchanged, freezing the original address does not reverse every trade or automatically capture the replacement asset.

The FBI’s published address list gives service providers a common reference for the laundering investigation. It does not give every infrastructure operator the same legal or technical ability to stop a transfer.

For customers, the practical consequence is that an announced freeze can be encouraging without representing completed restitution. The next reported event should identify whether assets were returned, to whom, through which process and in what quantity.

Binance used reserves that serve different purposes

SAFU is an emergency reserve intended to protect users in exceptional situations. A futures insurance fund normally serves a different function: covering losses left by liquidated positions when collateral is insufficient.

Binance’s use of insurance reserves made the composition of the recovery funding relevant to derivatives traders. The company said it used excess resources and that the remaining fund continued to satisfy its risk requirements.

An insurance fund’s dollar balance is not a measure of how much a particular trader will receive after a security incident. It is a resource supporting the exchange’s liquidation and loss-management arrangements, subject to the rules of the relevant futures products.

A simplified comparison illustrates the separate questions. An exchange could replace all stolen customer tokens while holding a smaller liquidation reserve than before the incident, unless it replenishes that reserve from another source.

Customers whose spot assets are restored would have their immediate backing question answered. Futures traders would still need information about the protection available when bankrupt positions leave losses behind.

The two outcomes are compatible. Restoring one pool does not, through accounting alone, restore every other buffer that contributed to it.

Binance’s October 31 disclosure identified three funding sources but did not provide an allocation for each source in that notice. Its statement that company funds were being used therefore needs to be read alongside the separate descriptions of SAFU and futures reserves.

Public disclosure of the amount drawn, the amount remaining and the replenishment schedule would make the funding consequences easier to assess. Such a schedule would need dates and the relevant reserve categories, because a single aggregate balance can conceal differences between products.

Customer account verification has another boundary here. Binance said users could verify their own assets through its proof-of-reserves system; that system is not a customer-level claim on the company’s futures insurance fund.

The commitment to absorb the theft assigns the loss to Binance. Explaining how the company funds that commitment helps customers distinguish the restoration of their assets from the continuing condition of the exchange’s other financial safeguards.

Binance’s insurance-fund rules explain the operational consequence of an insufficient liquidation buffer. Where losses on bankrupt positions exceed the relevant available fund, auto-deleveraging can be engaged under the product’s risk arrangements.

Its ADL explanation describes a mechanism which can reduce positions held by traders on the opposing side. It is different from paying a security-incident claim and should not be interpreted as a guarantee that profitable positions can never be affected by another trader’s bankruptcy.

The fund is also divided by the applicable contract arrangements. A total across categories does not establish that every dollar is available for every liquidation event.

That introduces a further disclosure question after money is drawn for recovery: whether the remaining resources cover the relevant products under the exchange’s stated framework. A percentage of the stolen assets replaced cannot answer that product-specific question.

Binance says its remaining reserves continued to meet required coverage. The published rules separately provide for company contributions if an insurance fund falls below the required minimum.

Reserve verification answers a narrower question than an audit

Binance completed reserve verification for 10 major cryptocurrencies on November 2, using a snapshot taken at 00:00 UTC on October 31. A completed cryptographic proof allowed eligible users to check their inclusion and the stated backing for that snapshot.

The covered assets were BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The snapshot time matters because it precedes the later stages of withdrawal reopening.

In its November 2 update, Binance scheduled a further snapshot covering more tokens for November 4. Generating the next full proof was expected to require approximately 40 to 50 hours.

Publication date and measurement date therefore need to be read separately. A proof completed on November 2 describes the stated October 31 position, rather than continuously certifying every balance as withdrawals are processed.

Binance’s proof-of-reserves explanation describes how account records and Merkle trees allow users to check that their balances were included. Its zero-knowledge mechanism supports verification without publicly exposing each individual balance.

Such a check is useful when customers want evidence beyond a company assurance. It still has a defined scope: particular assets, a particular set of account data and a particular measurement time.

The PCAOB’s investor advisory warns against treating proof-of-reserve reports as financial-statement audits. It notes that procedures can omit liabilities, ownership rights, borrowed assets and other information needed to assess an entity’s full financial position.

Its warning is a general one, not a finding that Binance’s latest proof is false. The appropriate comparison is between what the specific proof establishes and what a reader might otherwise assume it establishes.

A customer can ask whether an account was included, whether the chosen token was covered and when the snapshot was taken. Assessing the entire company would require further information on obligations, restrictions, capital and the resources used in recovery.

The response reached beyond Binance’s withdrawal system

Funds leaving an exchange can reach other services before the exchange finishes its initial investigation. An emergency response consequently involves platforms which were not themselves breached but may receive the stolen assets or accept them as collateral.

LlamaRisk’s Aave incident account describes a wallet in the exploiter’s cluster depositing 60 million USDT and borrowing 19,762 WETH between 20:58 and 21:01 UTC on October 29. The first market freeze followed at 21:42 UTC.

The risk provider said the position remained overcollateralised and subject to ordinary liquidation. Its account described a precautionary freeze because stolen assets could be swapped into other assets supported by the lending protocol.

An exchange’s withdrawal suspension cannot reverse that borrowing. Once funds have reached another service, the response depends on that service’s permissions, collateral rules and assessment of the threat.

The separate notices therefore need to be read at the level of the specific action. Binance restricting withdrawals and Aave freezing new lending activity address different transactions and different groups of customers.

Communication between firms can identify where intervention is possible, but it does not make their powers interchangeable. A token issuer can restrict its own token, a lending guardian can exercise protocol permissions and a rollup council can use the administrative tools its governance has authorised.

The restrictions depend on the relevant service’s rules. A freeze can stop new activity while leaving existing positions open, with its reversal assigned to the authorised body.

Binance’s own recovery communications have had another audience: customers trying to distinguish official instructions from people offering to accelerate withdrawals. Its public company feed warned that it would not sell queue positions, charge an unlocking fee or ask users to transfer funds to a supposed safe account.

The warning is relevant to the way a phased reopening works. Customers waiting for a particular token have an immediate reason to look for updates, while availability can legitimately differ between networks.

An unsolicited message can exploit that uncertainty by claiming the customer needs to complete an extra step. The requested action may be a wallet connection, signature or transfer dressed up as a recovery procedure.

The FBI’s recovery-fraud advisory describes schemes in which purported recovery firms request an advance payment, disappear or supply inadequate tracing material before asking for more. It states that private recovery firms cannot issue seizure orders.

A blockchain tracing report and the legal authority to seize assets are different things. Identifying a destination can help an investigation, but it does not by itself compel the holder, issuer or platform to transfer funds.

The FTC’s refund-scam guidance describes another part of the deception: fraudsters can know details of an earlier loss and use them to make a new approach sound credible. Familiarity with an incident does not establish that the caller represents the affected company.

During an exchange-wide recovery, public announcements supply much of that background to anyone. The size of the theft, reopening dates and affected assets can be copied into a convincing-looking message without access to a customer’s account.

The practical customer task remains specific: check the selected withdrawal route through the exchange’s own interface and distinguish a pending request from a demand for a new payment. The company’s published reopening process should explain the steps required without relying on instructions from an unknown intermediary.

Clear incident communications therefore do more than provide reassurance. They give customers a reference against which to check a request, particularly when a claim concerns fees, eligibility or a supposed compensation programme.

The withdrawal announcements themselves direct users to the asset and network status page. Their promise is a progressive operational reopening, with no published provision for purchasing priority in that queue.

Reimbursement does not explain how the breach happened

Altcoin Pro co-founder and chief research officer Joni Zhuleku argued in a November 2 interview that reimbursement alone was insufficient. He said Binance needed to explain the failure and demonstrate stronger controls to restore confidence.

His position addresses a different question from whether customers receive replacement assets. A fully funded reimbursement can resolve the immediate shortfall while leaving the reason for the unauthorised transactions unresolved.

Binance has presented its financial capacity and commitment to customers as grounds for reassurance. Richard Teng said on November 3 that the company remained financially strong and that inflows and outflows were largely returning to normal, according to Reuters.

The evidence for recovery should therefore include both the completion of the asset programme and the changes made to transaction authority. They are separate claims and can progress at different speeds.

Ethereum’s EIP-7702 specification makes explicit that signed authorisations can delegate an account’s behaviour to code. The associated implementation guidance warns that delegation can give the designated contract control over assets.

For an exchange, the relevant operational question is what its signing policy permits, including unfamiliar transaction types and persistent permissions. A system that recognises an ordinary transfer still needs to interpret an authorisation that changes what an account can subsequently do.

The comparison does not establish which Binance control failed. It identifies the permission that investigators must account for when reconstructing the Ethereum transactions alongside activity on other chains.

Disclosure should explain which protective changes apply immediately and which require further engineering. Replacing credentials, changing approval rules and rebuilding services are different actions, even when all appear under a general promise to strengthen security.

Customers can compare the finished report with the dated notices issued during the incident. Where the company revised an early explanation, the final account should show what new evidence changed its assessment.

Binance’s October 30 notice committed to publishing a detailed technical report covering the attack, lessons and safeguards. Its next announced reserve snapshot was scheduled for November 4, with a further 40 to 50 hours estimated for the full cryptographic proof.

What to watch

• Completion by asset: Whether Binance reports full replacement for tokens outside the 10 already covered.
• Withdrawal availability: Which remaining network and asset pairs become operational, and whether processing delays persist.
• Returned funds: Disclosures distinguishing completed recoveries from assets still frozen or held pending decisions.
• Reserve replenishment: Dated balances and replacement plans for SAFU and the futures insurance funds used in recovery.
• Technical findings: The final attack timeline, signing permissions involved and controls changed after the breach.

FAQ

How much was stolen in the Binance hack?

Binance estimated the October 29 theft at approximately $6.3 billion. TRM Labs valued the transfers it traced at approximately $6.36 billion using prices when the assets were taken.

Has Binance recovered 95% of the stolen cryptocurrency?

Its 95% statement described asset replenishment using company resources. Buying replacement tokens is separate from recovering the original stolen funds.

Did Binance reopen all withdrawals on November 3?

The November 3 notice expanded a phased reopening. Availability depends on the individual asset and network passing checks.

What does freezing stolen crypto achieve?

A freeze restricts movement through the relevant issuer or network mechanism. Returning the assets can require further technical, governance or legal action.

Which reserves funded the replacement purchases?

Binance named SAFU, a portion of its futures insurance fund and its corporate treasury. Its October 31 notice did not allocate the total among those sources.

What did the reserve verification cover?

The completed proof covered 10 cryptocurrencies using the October 31 snapshot. Eligible users could check their account inclusion and the stated minimum 1:1 backing.

Was a compromised laptop the confirmed cause?

Binance initially suggested a laptop compromise, then reported further breach points. Its technical investigation was intended to establish the full sequence.

Does reimbursement establish that an exchange is secure?

Reimbursement addresses the asset shortfall; the technical findings address how unauthorised transfers occurred and what changed. This is educational analysis, not investment advice.

Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. Figures reflect regulatory filings and reporting available at the time of writing and change with each disclosure. Nothing here is a recommendation to buy, sell, or hold any security or asset. Always do your own research. Information is accurate as of November 3, 2026. Legal questions should be discussed with qualified counsel.