Binance says it has replaced all customer holdings drained in the attack of October 29, 2026. On November 12 the exchange posted on its @binance account on X: “Binance has completed coverage
Binance says it has replaced all customer holdings drained in the attack of October 29, 2026. On November 12 the exchange posted on its @binance account on X: “Binance has completed coverage of assets impacted in the security incident.” According to Yonhap and crypto.news, the company spent more than $6.34 billion of its own money on the reimbursement. Customers did not have to file any claim; Binance closed the gap on its own balance sheet.
What is still missing is the proof anyone can verify for themselves. Binance plans to deliver the cryptographic proof for the new reserve snapshot only in the coming days, and withdrawals are still being reopened in phases. This overview sets out what has been documented, what is missing and what investors can take from it. Figures are as of Friday, November 13, 2026, around 12:50 CET.
According to crypto.news, the announcement came on Thursday evening. Binance reported two things at once: the holdings hit by the hack were fully covered, and a new snapshot for its proof of reserves had been published. A proof of reserves is a point-in-time record with which an exchange shows that for every unit of a coin credited to customers, it holds at least one unit itself.
Getting there took two weeks. On October 31 the coverage ratio stood at around 90 percent according to crypto.news, and at around 98 percent in early November. BTC-ECHO dates the 98 percent to November 2, crypto.news to November 4. The last few percentage points mainly concerned thinly traded tokens that Binance first had to buy back on the market because liquidity was lacking.
For context: the loss of around $6.3 billion is the largest known theft from a crypto exchange. According to BTC-ECHO, it is more than four times the $1.5 billion taken from Bybit in February 2025. Binance had promised full reimbursement the day after the attack, and we reported on that pledge and the SAFU fund on October 30. What is new is that the exchange now reports the reimbursement as complete.
According to Binance, the money came from three pots. First, the Secure Asset Fund for Users, or SAFU, an emergency fund the exchange keeps to compensate customers after security incidents; it usually holds around $1 billion. Second, the insurance fund of its futures business, and only the portion above the minimum balance its own risk model requires. Third, the corporate treasury.
According to TNGlobal and Gizmodo, Binance bought back the affected coins through regular trading and over-the-counter (OTC) deals. The exchange has not published how much came from each pot. BTC-ECHO paraphrases co-CEO Yi He as saying that this year's revenue would fully cover the hole.
Going forward, Binance has said it will top the SAFU fund back up to around $1 billion. It is to remain “fully resourced as an emergency user-protection reserve”, the exchange said in its statement quoted by Yonhap. The November 12 announcement does not say whether the top-up has already been completed.
Binance replaced the stolen tokens through market and OTC purchases, not with recovered loot.
According to TNGlobal and Gizmodo, the new reserve snapshot of November 12 covers 198 tokens. That is far more than the two interim snapshots: the one from October 31 covered only ten coins according to crypto.news, including bitcoin, ether, USDT, BNB, Solana and XRP, and the one from November 4 covered 44 tokens.
The second part is what matters, though. A snapshot on its own is a statement by the exchange. It only becomes verifiable through a zero-knowledge proof, or ZK proof: a cryptographic method that lets every customer check that their own balance is included in the total and backed, without the exchange having to disclose other customers' holdings. Binance has yet to generate this proof and puts the computing time at 40 to 50 hours.
BTC-ECHO points out that until then, customer funds of around $132 billion are backed only by Binance's word. That is not an accusation but the normal sequence: for the November 4 snapshot, Binance had already estimated 50 to 60 hours of computing time, according to crypto.news. Anyone holding coins on Binance can check their own coverage on the exchange's proof-of-reserves page once the process is complete.
After the attack, Binance halted withdrawals and began reopening them step by step from November 1. In the first nine and a half hours, customers pulled out around $4.65 billion according to crypto.news, while $1.01 billion in deposits came in. On balance, a little over $3.6 billion left the exchange. BTC-ECHO cites around $2 billion for the first hours; the gap reflects different measurement windows.
Even with the November 12 announcement, the reopening is not complete for every coin. Binance says withdrawals will continue to be released in phases, with confirmations following one by one. The reports we reviewed do not name the coins that are still blocked; the overview in the exchange's app is what counts.
The outflow has left its mark. On November 6, the analytics firm Santiment estimated that a net 28,316 bitcoin had left wallets attributed to Binance since the attack. Santiment itself notes that exchange bitcoin balances had already been falling before the hack.
The reimbursement news did little for the in-house token. BNB traded at around $640 on Friday at about 12:50 CET, 3.7 percent below the previous day according to CoinGecko. That has less to do with Binance than with the wider market: bitcoin lost 4.8 percent over the same period to around $69,400, and ether fell 3.2 percent.
For BNB holders the reimbursement still matters. The token is closely tied to the exchange's business, serving as its fee currency and as the fuel of BNB Chain. An exchange that can raise $6.34 billion from its own funds without burdening customers has defused a solvency risk for now. Whether the hole in the balance sheet will slow growth in the coming quarters cannot be read from the figures published so far.
Separately from the reimbursement, the hunt for the stolen funds continues. The FBI attributes the attack to the North Korean group TraderTraitor, which the analytics firm TRM Labs also holds responsible for the Bybit hack. North Korea denies the allegations. According to BTC-ECHO, investigators had frozen around $2.8 billion by early November, based on Chainalysis data; other reports put the figure between $2.7 billion and $3 billion.
Frozen does not mean repaid. The funds sit blocked with stablecoin issuers or other exchanges until courts rule on them. The US Department of Justice said on November 12 that courts had approved the seizure or restraint of more than $1.2 billion from the Binance hack; the statement is on the Department of Justice website. If any of that money later flows back to Binance, it will ease the exchange's balance sheet, but it no longer changes anything for customer reimbursement.
Large hacks are typically followed by waves of phishing in the name of the affected exchange.
For investors in Europe there is a second issue that has nothing to do with the hack. As cryptoticker.io reported on November 8, Binance holds no licence in the EU under the European crypto regulation MiCA and still serves customers from the bloc. Since the transition periods ended, the Markets in Crypto-Assets Regulation (MiCA) has governed which providers may hold and trade crypto assets in the EU.
According to consistent media reports, Binance has told customers in France, Spain, Italy and Poland that their accounts will be closed on December 31, 2026. Up to our report of November 8 there was no evidence that accounts in Germany were included. Anyone in Europe still holding funds on Binance faces the question of where to move them. Our comparison of regulated crypto exchanges with a MiCA licence lists the licensed providers. A licensed provider must, among other things, keep client assets separate from its own and is supervised by a national authority, in Germany the BaFin.
What happened: On October 29, 2026, attackers drained crypto assets worth around $6.3 billion from Binance wallets; the FBI blames the North Korean group TraderTraitor. On November 12, Binance said it had replaced all affected customer holdings with more than $6.34 billion of its own funds (as of November 13).
Are you affected? Customers whose coins sat in the exchange wallets that were attacked were affected. According to Binance, they did not need to file a claim; their holdings were replaced on the exchange. If you never had a Binance account, you were not affected by the theft, but you can still be targeted by scam emails in the exchange's name. Right now, with the reimbursement in the headlines, fake reimbursement or verification emails are an obvious lure.
Our guide on how to store crypto safely covers the basics, and our hardware wallet comparison reviews suitable devices.
The Binance case shows both sides of keeping coins on an exchange. Customers have their money back because a large exchange with deep reserves could absorb the loss. At a smaller provider with thin capital, the same attack would very likely not have ended without losses for customers. And even at Binance, withdrawals were frozen for days.
A hardware wallet is a small device that stores private keys offline, so attackers cannot reach them even if your computer is infected. If you keep your coins there, an exchange hack does not affect you, but you carry the responsibility for the recovery phrase yourself. For many investors a split makes sense: trading funds on a licensed exchange, long-term holdings in self-custody.
The reimbursement is complete; the independent proof is not. Three steps help you make sensible use of the coming days:
(As of November 13, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
