Binance has replenished 98% of the $6.34 billion in affected assets following the October 29, 2026 security breach, CEO Richard Teng said on November 3. The exchange has also completed its latest Proof of Reserves verification as it works to restore user confidence after the theft.
Key takeaways
Binance’s replenishment figure rose from 90% to 98%.
Proof of Reserves lets users independently check asset backing.
Binance is purchasing the remaining, less-liquid assets.
The exchange has rebuilt affected systems and is seeking an independent review.
Richard Teng details Binance’s replenishment progress
Richard Teng said Binance has replaced most affected assets using its own resources, while purchases of the remaining, more illiquid assets continue. The exchange has pledged to cover all customer losses .
The 98% figure follows an earlier update reporting roughly $5.7 billion, or 90% , replenished. Binance said it used its corporate treasury to buy cryptocurrency through markets and private brokers. It also drew on its Futures Insurance Fund after an emergency fund of about $1 billion proved insufficient.
Withdrawals began reopening in phases on November 1 , following temporary restrictions. Binance said net outflows reached about $3.64 billion in under 10 hours.
The attack involved months of preparation, Teng said. Binance’s security report describes a wallet infrastructure engineer downloading a tampered Homebrew installation in June while seeking an AI coding tool. Binance detected suspicious activity, replaced the device and rotated credentials, but information about the engineer and colleagues had already been exposed.
In September, attackers posing as recruiters put another engineer through interviews and a coding exercise containing hidden malware. Teng said the intrusion extended through internal AI tools into the system authorizing wallet transactions, rejecting the initial explanation of a single compromised laptop.
Proof of Reserves targets user confidence
Binance’s completed Proof of Reserves verification aims to strengthen confidence through transparency and accountability. Users can independently verify asset backing through the process.
Teng reported the verification’s completion in a statement on X. Binance has placed user protection and compliance at the center of its response as security challenges have brought increased regulatory scrutiny.
Security collaboration extends to tracing stolen funds
Binance is working with law enforcement and industry partners to trace and freeze stolen assets while strengthening its internal defenses. Teng has emphasized industry-wide security collaboration as part of the response.
The FBI attributed the theft to North Korea’s TraderTraitor group and urged cryptocurrency services to block transactions involving listed addresses. Teng acknowledged that attribution without independently assigning responsibility.
About $3 billion in assets were reportedly frozen through efforts involving Binance, Tether, Circle and Ripple. Coinbase blocked transfers to compromised wallets and offered direct assistance. Elliptic said attackers had converted about $786 million into currencies that were harder to trace.
The breach caused a sharp but short-lived loss of confidence across cryptocurrency markets. Binance maintains that it remains financially sound.
As of November 3, Binance had rebuilt the affected wallet system and internal AI tool, replaced compromised devices, revoked associated credentials and tokens, and expanded employee-device security scans. Teng also said an independent expert review was being arranged.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
