This Binance hack update changes the question. On Thursday the question was how much was gone. On Saturday Binance said it has replaced 90 percent of the $6.3 billion stolen in the largest crypto theft on record, that the ten biggest tokens on the platform are fully backed again, and that withdrawals stay on track to reopen on Sunday November 1. That is real progress, and it is still not the finish line. If you hold crypto anywhere, the next two days will show you the difference between a company saying your money is safe and a company proving it. Our Crypto hub keeps this story and the wider market reaction in one place.
Binance Hack Update: What Changed on Saturday
Here is what the third recovery update actually said, as reported by CoinDesk and Cointelegraph. Binance has replenished about 90 percent of the stolen assets, up from about 80 percent in its previous update. Customer holdings of bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed. The remaining 10 percent is made of smaller and less liquid tokens that Binance says will take longer to buy in the amounts it needs, and it is buying them through public markets and over the counter trades with industry partners.
Binance also published a new proof of reserves snapshot, taken at midnight UTC on October 31, showing coverage ratios of 100 percent or more for the named tokens. The full cryptographic proof, the version that lets each user verify that their own balance sits inside the reported liabilities, is expected by November 3 and takes about 40 to 50 hours to generate. Withdrawals, paused since the attack, remain on track to reopen on Sunday in phases, subject to final security checks. As our first Binance hack coverage put it on Friday, restored withdrawals and a reserve snapshot at full strength were the two proof points that mattered. Both are now in motion.
Replaced Is Not the Same as Recovered
One word in this story does heavy lifting, and readers should not let it slide past. Replaced does not mean recovered. Binance has not clawed 90 percent of the stolen crypto back from the attackers. It has spent its own money to buy replacement tokens so that customer balances are backed again. About $3 billion of the stolen assets were frozen with help from partners such as Tether and Circle, and that frozen money is separate from the replacement buying.
That distinction matters for two reasons. First, it tells you who is paying for this failure. Binance says it will, in its own words, absorb the financial impact of these stolen funds, not our users. Second, it tells you the stolen coins are still out there. Blockchain firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korea linked hacking group, though that remains a firm attribution and not a confirmed official finding. CoinDesk also reported that investigators have found additional breach points beyond the first suspected compromised employee laptop, so the account of how this happened is still growing, not closing.
Where the Replacement Money Comes From
Binance said it had already set aside more than $6.34 billion in company funds, including $5 billion held in the affected cryptocurrencies. The replacement assets are being funded from three places: its corporate treasury, a portion of its futures insurance fund, and a partial use of SAFU, its Secure Asset Fund for Users, expected over the next 24 hours. Binance said it used only the part of the futures fund above its required size, that the fund still meets its risk rules, and that it will restore SAFU to about $1 billion.
Read those details the way you would read a bank statement, not a press release. A healthy sign is that the company named its funding sources and put numbers on them. A fair question is what it did not share. Its spokesperson did not say how much each source contributed, did not disclose the minimum size its futures fund must keep, and did not say how much stolen crypto has actually been recovered. The security firm CertiK had already said on Friday that it needed more information to verify the claimed $5 billion in replacement crypto. Asking for that verification is not pessimism. It is the whole lesson of this week.
What the Reserve Snapshot Proves and What It Does Not
A reserve snapshot is a photograph, not a film. The October 31 snapshot shows that, at one moment, the wallets Binance reported held at least as much of each named token as customers held in balances. That is worth having, and it is more than most failed exchanges ever offered. It does not by itself prove what happens next week, which is why the November 3 cryptographic proof matters: it lets users check their own inclusion instead of trusting a summary table.
Market stress also tells only part of the story. United States spot bitcoin funds lost $643 million on Friday October 30 as holders reacted to the breach, a move our coverage of Bitcoin ETF outflows and what one loud day means helps put in proportion. Bitcoin traded near $77,000 on Saturday and held above its post attack low. Prices calming down is not proof that custody is fixed. It is only proof that sellers ran out of urgency.
Why Sunday Withdrawals Are the Real Test
Everything so far has been words, numbers and snapshots. Sunday is an action. When withdrawals reopen in phases, thousands of users will test the promise at the same time, and the system will either move their coins or it will not. Expect a phased restart rather than a single moment when everything opens at once, and expect some tokens and networks to return before others, especially while the last 10 percent of less liquid tokens is still being bought.
Your takeaway is simple. Treat Sunday as an exam with three grades. Withdrawals that actually arrive are the first grade. The November 3 proof that includes your balance is the second. A plain technical report that explains every breach point is the third. Until all three land, keep your own records, move savings you cannot afford to see frozen into a wallet you control, and ignore every message that offers to speed up your refund or verify your wallet for a fee. That message is the second theft trying to follow the first.
Want a calmer system for decisions like this one? Download the free playbook at Unlocking Financial Freedom and get practical money moves you can use this week, with clarity instead of noise.
