Binance funds after the hack: reserves, withdrawals and the proof of reserves report

After the $6.3 billion Binance hack on 29 October 2026, the question for its users was not who did it. It was simpler: is my money still there?

Binance's answer has come in a series of updates over three days, each with a bigger number: 80% replenished, then 90%, then 95%. This post puts those updates in one place, explains what each figure means, and is honest about what has been independently verified and what has not. Everything here is as of 1 November 2026.

The short version

• Money set aside: more than $6.34 billion, from Binance's SAFU fund, surplus futures insurance fund and corporate treasury.
• Replenished: about 95% of affected assets (roughly $6 billion of $6.3 billion), up from 80% on 30 October and 90% on 31 October.
• Fully backed: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, according to Binance.
• Withdrawals: reopened in phases from 1 November, starting with Bitcoin.
• Proof of reserves: snapshot taken 00:00 UTC on 31 October; full zero-knowledge proof expected by 3 November.
• Not yet verified: the full proof, the incident report, and how much of the $3 billion frozen will actually come back.

Where did Binance get $6.34 billion?

Binance has named three sources:

1. SAFU, the Secure Asset Fund for Users. An emergency fund Binance created in 2018, funded from a share of trading fees. It had been kept at around $1 billion.
2. Excess Futures Insurance Fund reserves. The fund that covers losses when leveraged traders are liquidated below zero; Binance is using the surplus above what it needs.
3. The corporate treasury. Binance's own money. NBC News put Binance's balance sheet at about $167 billion, which is why a loss this size is survivable for it when it would end almost any other exchange.

Binance says it will rebuild SAFU to about $1 billion afterwards.

What does "95% replenished" actually mean?

This is the most misunderstood number of the week, so it is worth being precise.

It does not mean 95% of the stolen money has been recovered from the hackers. It means Binance has put back, from its own funds, assets equal to 95% of what was taken, so that customer balances are covered by real coins again.

The steps, as Binance reported them:

The frozen $3 billion is a separate matter. If Tether, Circle and others eventually release it back to Binance, it reduces Binance's own loss. It does not change what customers are owed, because Binance has already covered that.

Which withdrawals are open?

Binance reopened withdrawals in phases on 1 November 2026. Bitcoin went first; Changpeng Zhao (CZ), Binance's founder, who no longer runs the company, posted "BTC withdrawal is live."

The first phase opened in a 06:00 to 09:00 UTC window (11 a.m. to 2 p.m. in Pakistan) and covers selected assets on 15 networks:

Each asset and network pair passes its own security check, so a network appearing in the list does not mean every token on it opened at the same moment. Binance co-founder Yi He said other currencies' wallets "are still undergoing repeated security audits", and later phases will be prioritised by market value, balances held and customer usage. Deposits were never suspended.

Binance has also said all withdrawals will be routed through new wallets, and it has updated its published proof of reserves addresses accordingly.

What is proof of reserves, and what will it show?

Proof of reserves is Binance's way of showing that it holds at least as many coins as it owes customers, without revealing anyone's balance. It has two halves:

• Assets: the wallet addresses Binance controls, which anyone can check on the blockchain.
• Liabilities: the total of all customer balances, proved with a zero-knowledge proof, a cryptographic method that lets you check the total is correct and that your own balance is included, without seeing other people's.

Binance took a fresh snapshot at 00:00 UTC on 31 October and published the headline figures on its proof of reserves page. The full zero-knowledge proof takes an estimated 40 to 50 hours of computing, and Binance expects it by Tuesday 3 November.

When it lands, check three things:

1. Ratio above 100% for the assets you hold. Binance already claims 100% backing for its top ten.
2. Your own balance is included. The proof of reserves page lets you verify your account against the snapshot.
3. The asset list matches the stolen list. The less liquid tokens in the final 5% are the ones to watch.

What proof of reserves does not prove

It is a good tool with known limits, and it is fair to name them:

• It is a snapshot. It shows the position at one moment, not that nothing moves afterwards.
• It covers customer liabilities, not Binance's other debts. An exchange can hold all customer coins and still have other obligations.
• It is not a full audit by an independent accounting firm.

That is why the second document matters: Binance's detailed incident report, promised once its investigation concludes. It should explain how the attackers got in and what has changed. Until it is published, "it's fixed" is Binance's word.

Why this is different from FTX

When the news broke, Elon Musk replied to a post comparing Binance with FTX, which had also said customer funds were safe days before it collapsed in 2022. CZ replied: "Elon, have a lot of respect for you, but bad time to troll."

The comparison is understandable but the situations differ in one way that matters. FTX's hole was created by the company itself spending customer money; the funds were never there. Binance's hole was created by theft from outside, and Binance has shown it can fill it from its own balance sheet within days. Whether it handles the aftermath well is a separate question that the proof and the incident report will answer.

What we would do as a Binance user

• Withdraw only what you need to move, through the official app, once your network reopens. Withdrawing everything at once mostly adds to queues.
• Verify your balance against the 31 October snapshot when the proof of reserves is published.
• Keep long-term holdings you do not trade in a wallet you control. We explain how in our guide for crypto users in Pakistan, which applies anywhere.

If you run a business that holds funds or customer money digitally, the same discipline applies to you: reserves, reconciliation and a tested incident plan. That is the kind of operations work we do, and our business continuity guide is a free starting point.

Frequently asked questions

Has Binance recovered the stolen money?

About $3 billion has been frozen, mostly stablecoins, but not yet returned. Separately, Binance has replenished about 95% of the stolen assets from its own funds so customers are covered.

Where did Binance get the money to cover the hack?

From its Secure Asset Fund for Users (SAFU), surplus futures insurance fund reserves and its corporate treasury, more than $6.34 billion in total.

When is the Binance proof of reserves report?

A snapshot was taken at 00:00 UTC on 31 October 2026. The full zero-knowledge proof was expected by 3 November 2026.

Can I withdraw from Binance now?

Withdrawals reopened in phases on 1 November 2026, starting with Bitcoin and major stablecoins. Some networks opened later.

What is the Binance SAFU fund?

The Secure Asset Fund for Users, an emergency fund created in 2018 from a share of trading fees to protect customers in cases like this one.

Sources

crypto.news: Binance reopens Bitcoin withdrawals and Binance reserves $6.34B after hack; TechJuice for phase-one networks in PKT; NBC News for statements and the FTX exchange; Crypto Briefing for the new withdrawal wallets; Wikipedia: 2026 Binance hack. Figures as of 1 November 2026.