- Binance says it has fully replaced, with company funds, the customer assets drained in the October 29 hack.
- Every major asset in the new proof of reserves snapshot is backed at or above a one-to-one ratio.
- Users can’t verify the snapshot themselves until Binance publishes the zero-knowledge proof.
- Replacing customer funds doesn’t mean the stolen crypto is back, and US authorities are still pursuing it.
Binance said on November 12 that it has finished replenishing every customer asset affected by the October 29 breach. It closed a shortfall of more than $6.34 billion with money from its corporate treasury, its Secure Asset Fund for Users (SAFU) and its futures insurance fund. The exchange also published a new proof of reserves (PoR) snapshot covering 198 tokens, and once the matching zero-knowledge proof is generated, users will be able to confirm on their own that their balances are backed at least 1:1. The announcement came on the same day the US Department of Justice said it had obtained court authorization to seize or restrain more than $1.2 billion of the stolen funds, which the FBI attributes to the North Korean hacking group TraderTraitor.
Eleven days to close the gap
Binance’s recovery updates show the shortfall shrinking in stages. By November 1 the exchange had replenished about 95% of the affected assets. Its November 4 update raised the figure to 98%, with Binance buying the outstanding tokens through open-market trades and over-the-counter (OTC) channels, where large blocks change hands privately without moving public order books. The final portion consisted mainly of less liquid cryptocurrencies that are hard to buy in large amounts, which explains why the last few percent took another week.
Each new reserve snapshot also checked more tokens than the one before it. The October 31 snapshot verified backing for 10 assets and the November 4 snapshot for 44. The latest one extends the check to 198 tokens, so users holding smaller altcoins can now see whether those balances are covered too.
A thin cushion on Bitcoin
According to Binance’s PoR page, all eight of its largest assets sit above 100%, though the margins differ widely. Bitcoin stands at 100.05%, with 688,284 BTC held on-chain against 687,912 BTC in net user balances, which leaves a surplus of only about 372 BTC. That is a small buffer for an asset the attackers took 18,270 BTC of, and it suggests the exchange bought back almost exactly what it owes customers in Bitcoin.
Solana has a wider margin: its ratio of 105.86% leaves about 1.45 million SOL above user balances, more than the roughly 970,500 SOL drained in the attack. XRP sits at 102.15% with a surplus of about 52.4 million XRP, after 233.46 million XRP left the exchange’s wallets on October 29. The highest ratio belongs to WBETH, Binance’s token representing staked Ether, at 115.24%. Some of the reserves are held outside Binance’s own wallets, including about 10,540 BTC and 306.7 million USDT with third-party custodians, and the snapshot counts these toward the totals.
How the 1:1 check works
The ratio divides the coins Binance holds on-chain by the net balances users hold on the exchange, so anything above 100% means the wallets contain more coins than customers could claim. A Merkle tree compresses millions of account records into a single cryptographic fingerprint, and it lets each user confirm their own balance was included. The zero-knowledge proof then shows mathematically that the assets in the snapshot are backed at least 1:1 without revealing any individual account. It also rules out the old trick of entering accounts with negative balances to make liabilities look smaller.
Generating that proof is slow. For the November 4 snapshot Binance estimated about 40 to 50 hours, so for now users have to take the 198-token snapshot on trust. A PoR also only measures what Binance owes customers in the listed tokens and leaves the company’s other obligations out, which is why it confirms customer coverage at a single moment without auditing the full balance sheet.
Who gets the seized $1.2B
Because Binance paid for the replacement itself, recovering the stolen crypto is now a separate legal process. The DOJ said more than $2.7 billion has been frozen with help from crypto companies, and the $1.2 billion under court orders is included in that figure. Authorization to seize or restrain funds starts forfeiture proceedings, in which a court decides who owns the assets, and none of the money has been returned yet. The rest of the stolen funds scattered quickly, with Elliptic tracking roughly 12,000 wallets across 11 blockchains in the first three and a half days of laundering.
SAFU’s balance is the next number to watch
Binance hasn’t disclosed how much it took from SAFU or the futures insurance fund, or how quickly it plans to refill them. SAFU exists to protect users in incidents like this one, so its size after the payout determines how much protection is left for any future breach. If forfeited funds eventually reach Binance, they would offset part of a loss the exchange has already covered, with no effect on customer balances.
The exchange’s internal investigation is the other open thread. Binance has said the attackers used Ethereum’s EIP-7702 mechanism to hand signing permissions to a malicious smart contract, and those authorizations stayed active even after normal withdrawals were halted. Independent reviews of how that was possible, and of whether every delegation has been revoked, are likely to get as much scrutiny as the zero-knowledge proof once it is released.
