Binance says roughly 80% is already replenished
Binance says it has placed more than $5 billion in the same token assets affected by the hot-wallet theft, covering approximately 80% of the roughly $6.3 billion stolen.
The exchange says it has prepared more than $6.34 billion in company funds for the response. It is buying the remaining approximately 20% through market and over-the-counter channels so the replacement assets match the tokens that were taken.
This replenishment is separate from the approximately $3 billion frozen on-chain with help from issuers and industry partners. Frozen assets remain subject to recovery and verification and should not be added to the replacement funds as if both figures were recovered cash.
Why Signal21 is using 80%, not 90%
A report amplified on X said that 90% of the stolen assets had been replenished. Binance's current formal incident update says about 80%, based on more than $5 billion of matching assets against an approximately $6.3 billion loss.
Signal21 is therefore using the primary-source figure. The percentage may rise as Binance completes additional market and OTC purchases, but 90% is not supported by the official update available at publication time.
Withdrawals may begin returning within about 34 hours
Binance says its technical team aims to start restoring withdrawals in phases within approximately 34 hours, subject to security checks. Each asset or network may reopen at a different time.
The new statement also clarifies that deposits and other unaffected platform services remain operational. Earlier reporting described a broader suspension during the first emergency response; the latest official position is that withdrawals are the restricted service.
Binance plans to take an initial Proof of Reserves snapshot within 12 hours of its update and publish the result by Monday, November 2, 2026. That report should provide the first independently inspectable view of platform holdings after the replacement purchases.
The attack explanation is becoming more complex
Binance initially pointed to a compromised laptop as a possible entry point. Its subsequent investigation has found additional points of breach, although it has not described them publicly.
The exchange still says it has found no evidence that wallet private keys were leaked. It expects to share further verified technical findings within about 48 hours and promises a full post-mortem later.
This makes the current explanation broader than the first DevOps-laptop account. A compromised laptop may have been one entry point rather than the complete attack path.
What remains to be verified
- whether withdrawals actually begin reopening within the announced window;
- whether the Proof of Reserves confirms full backing of customer balances;
- how much of the approximately $3 billion frozen is ultimately recovered;
- what the additional breach points were;
- and whether Binance's final reconciled loss remains near $6.3 billion.
The precise status is now: Binance says about 80% of the stolen token assets has been replenished, more than $6.34 billion in company funds is prepared, deposits are unaffected and withdrawals should begin returning in phases within about 34 hours. These are company statements pending the promised Proof of Reserves and technical report.
Follow Signal21's complete Binance incident timeline for the earlier transfers, issuer freezes, protocol precautions and preliminary attack theories.
This is a developing story. Signal21 will update the coverage when withdrawals resume or Binance publishes its Proof of Reserves.