Binance says it has allocated more than $6.34 billion of its own resources to cover losses linked to its October 29 security incident, with $5 billion already held in the same tokens as the affected assets. The exchange says it is buying the remaining tokens through market and over-the-counter transactions while trying to recover assets frozen after the breach.
In an October 30 update from an official Binance regional account, the company said its corporate allocation excludes roughly $3 billion in assets frozen with industry partners. It also said it would use its public Proof of Reserves system to verify customer holdings as remediation progresses. The allocation and the frozen-asset total must not be added together as though both were completed reimbursements.
Why Binance is holding matching tokens
The exchange said $5 billion of its allocation is already in the affected asset types, rather than merely being an equivalent dollar amount. It is sourcing the remainder from open markets and over-the-counter counterparties to match the tokens associated with the shortfall. Based on the announced figures, the gap between the committed resources and tokens already held is at least about $1.34 billion, although the precise composition was not disclosed.
Matching assets matters because replacing a stolen quantity of one token with dollars does not automatically restore the same crypto exposure. Binance warned that some purchases may take longer when token liquidity is limited or OTC settlement is delayed. That is an operational limitation, not evidence that every outstanding balance has already been replenished.
Frozen funds remain a separate recovery process
Binance said approximately $3 billion of affected assets had been frozen through cooperation with issuers and other industry participants. Freezing can restrict the movement of assets, but it does not itself demonstrate that funds have been returned to the exchange or to customers. Recovery still involves verification and, potentially, legal and technical steps.
In its initial incident disclosure, Binance estimated the total impact at around $6.3 billion and described an investigation into a potentially compromised engineer’s device. Separately, TRM Labs attributed the transfers to a North Korea-linked group, an assessment that remains distinct from any final finding by law enforcement.
What the proof of reserves will establish
Binance has promised a refreshed Proof of Reserves once remediation is complete. Such disclosures may help readers examine reported customer backing, but they are snapshots and should be assessed alongside liabilities, custody and the scope of third-party checks. BlockBriefing’s hot and cold wallet guide explains why custody design and access controls remain relevant even when exchanges publish reserve figures.
The timing of full token replenishment, the amount of successfully recovered frozen assets and the incident’s final technical cause remain open questions. This report reflects Binance’s stated commitments, not an independent audit of its financial position or a guarantee about the recovery timeline.
Primary source and verification
Read Binance’s October 30 corporate recovery statement and its initial security notice. Figures are attributed to the company and may change as its investigation develops.
