Binance Reserves $6.34B After Hack, Buys Replacement Tokens

Binance buys tokens to match stolen assets

In its official replenishment disclosure, Binance said purchases through markets and over-the-counter channels were intended to match the affected tokens. It warned that limited liquidity and settlement times could delay the process.

That is a material development beyond the earlier loss-coverage pledge. The initial report described an estimated $6.3 billion impact and roughly $3 billion frozen. The new action concerns financing and executing replacement purchases, rather than another increase in the headline theft estimate.

The distinction is practical. An exchange owing customers a particular token needs access to that token when withdrawals resume. A dollar-denominated reserve commitment alone does not show that each asset is available in the quantity required.

Buying on public markets means trading against available sellers. Over-the-counter transactions are negotiated directly with counterparties and can require time to settle. Either route can leave a gap between allocating money and having transferable balances ready.

The disclosure provides no completed token-by-token reconciliation, purchase prices or settlement schedule. It therefore cannot establish that every affected balance has been restored. Nor does the purchase program support a forecast that any particular token will rise: execution details and remaining quantities were not disclosed.

Binance hack losses span ten blockchains

The dedicated loss-impact check for this follow-up, completed at 17:00 UTC on October 30, found TRM Labs’ estimate of approximately $6.36 billion in transfers from Binance-attributed wallets across ten blockchains, valued when the assets moved. TRM put the same assets at about $6.23 billion at its report’s prevailing prices.

Its breakdown included about $3.79 billion on Ethereum and 18,270 BTC, worth about $1.47 billion. The firm attributes the attack to North Korea’s TraderTraitor group. That is the investigator’s assessment, rather than a final public finding by law enforcement.

TRM described preparation beginning at least 36 hours before the theft, followed by concentrated withdrawals and later sweeps. Those observations concern stages of this incident; they do not establish another wave of compromised retail accounts.

Neither the reviewed company disclosures nor that analysis supplied a verified affected-customer count or a final net customer-loss total. Exchange wallet counts and attacker addresses should not be substituted for people affected.

There is also a concrete recovery action. The Arbitrum Security Council reported freezing 8,425 ETH and 74,559,805.2 ARB associated with the exploit. It said the assets were moved to a holding address and could only be moved through an ArbitrumDAO governance vote.

That establishes a restriction on those funds, rather than their return to Binance. Adding the council’s token amounts to an exchange-wide freeze total without reconciling its scope could count the same assets twice.

Withdrawals and reserve verification remain separate tests

A subsequent Binance investigation update said investigators had found other possible entry points beyond the initially suspected compromised laptop. It said deposits were unaffected, updating the initial announcement that had suspended both deposits and withdrawals.

The same update expected withdrawal restoration within its next 45 hours. That was a forecast attached to that disclosure, not confirmation of reopening or a rolling deadline starting when this article is read. The reviewed replenishment statement did not establish that withdrawals had resumed.

Operational access and balance-sheet funding answer different questions. An exchange can allocate replacement capital while keeping transfers paused for security checks. Conversely, restoring a transfer interface would not by itself verify every asset backing customer claims.

Binance says public proof of reserves will permit verification of user funds. Assessing that evidence requires attention to its snapshot date and asset coverage. A pre-incident snapshot cannot demonstrate that subsequent replacement transactions have settled.

The custody stakes extend beyond this exchange, as Coinbase’s latest earnings showed large customer stablecoin balances. Adoption and earnings figures describe business activity; customers also depend on access to the particular assets held for them.

The Fear & Greed Index stood at 30, or Fear, down from 51 the previous day. The gauge measures market sentiment and does not assess an exchange’s solvency or the completeness of recoveries.

The next verifiable milestones are completed purchases, a dated reserve reconciliation, confirmed withdrawal access and decisions returning frozen assets. Until those are published, corporate funds committed, tokens obtained and stolen funds recovered remain separate measures of the response.