Binance Reserves $6.34B to Cover Hack Losses, Buys Back Stolen Altcoins

Published October 30, 2026, 05:20 PM PKT. This is a follow-up to MABOnChain's October 30 articles on Binance's investigation into a suspected multi-billion wallet drain, its pause of withdrawals, its pledge to cover all losses and suspend all deposits and withdrawals, its first findings pointing to a compromised DevOps engineer's laptop, TRM Labs' attribution of the hack to North Korea, its expectation to begin resuming withdrawals within 48 hours, and its finding of additional breach points. It is based on Binance's statement on X on October 30, 2026 (primary source for the $6.34 billion reserve and the altcoin buyback, as reported by CoinTelegraph's live blog, Crypto Briefing and Unchained), and on a CoinDesk review of Binance's reserve data via CryptoNews and a Chainalysis laundering note (secondary sources). Where sources disagree, this article says so rather than picking a winner.

Binance has now put a dollar figure on the money it is setting aside to make customers whole, and it is a figure slightly larger than the hack itself. In a statement posted on X on October 30, carried by CoinTelegraph's live blog at 10:55 UTC, Binance said it has reserved more than $6.34 billion in company funds for the incident, against an estimated total impact of around $6.3 billion from the October 29 drain of its hot wallets. The reserve is the first concrete funding number Binance has given since co-chief executive Yi He pledged on October 30 that Binance would bear all hacking losses, and it turns that pledge from a promise into a balance-sheet commitment with a specific composition. Of the more than $6.34 billion, Binance said $5 billion was already held in the same tokens affected by the attack, and it is purchasing the remaining assets through market and over-the-counter transactions to address token shortfalls. That split is the key detail, because it means most of the cover was already on Binance's books in the right assets, while the remainder has to be bought, and bought in the right tokens rather than replaced with cash or with bitcoin and ether alone. Binance said the allocation excludes frozen or protected assets, so the roughly $3 billion already frozen on-chain with industry partners sits outside this reserve, not inside it, and efforts to recover those frozen funds continue alongside law enforcement and industry partners. Binance added that company resources will cover any confirmed shortfall, and that all user funds will ultimately be verified publicly through its proof of reserves.

Buying every stolen altcoin back, token for token

Yi He gave the buyback its sharpest formulation. In a post on X on October 30, carried by CoinTelegraph's live blog at 11:07 UTC, the Binance co-founder and co-chief executive said the exchange's Secure Asset Fund for Users, known as SAFU, and Binance's holdings include a large amount of assets such as bitcoin and ether, and that Binance is currently buying, through over-the-counter deals and on-exchange trades, all the stolen altcoins in fully matching amounts. Crypto Briefing quotes the same statement, and Unchained reports Yi He added that Binance was buying all the stolen altcoins in fully matching amounts as it prepares its updated proof of reserves. The phrase fully matching amounts is doing the real work here. Binance is not promising to reimburse customers in dollars, or in bitcoin, for altcoins that were taken. It is buying back the same tokens, in the same quantities, so that its reserves can be shown token by token against what customers hold. That is what makes the updated proof of reserves possible at all: proof of reserves compares Binance's wallet holdings with customer balances asset by asset, and a shortfall in one altcoin cannot be papered over with a surplus in another. Binance said it would provide another update once the purchases are complete, and it warned that some purchases could take longer because of low liquidity and over-the-counter settlement times. That warning matters for the smaller tokens in the stolen set, where buying matching amounts on thin markets takes time and can itself move prices, and it is the reason Binance has given no completion date. Until the purchases finish, the updated proof of reserves cannot be published in full, and customers should treat any claim that the buyback is done as unverified unless it comes from Binance's own channels.

Proof of reserves, and the gap it has to close

The buyback is necessary because of a finding that landed separately on October 30, and it explains why the reserve figure matters beyond reassurance. A CoinDesk review of Binance's own reserve data, reported by CryptoNews, found that the wallets emptied in the October 29 hack are the same wallets Binance lists as proof that customers' crypto is fully backed. Every month, Binance publishes a list of wallets it controls and what they hold, and compares those totals with what customers hold on the platform. Its most recent report, dated October 1, includes a wallet labeled Binance 14, the wallet at the center of the attack, which at the time held 1.26 billion USDT and 89,475 ether, among 37 assets. According to the review, the attacker used Ethereum's EIP-7702 feature, which lets a wallet hand control to a piece of software, and after getting Binance 14's key to sign that permission, turned the wallet into a sweeper that forwarded incoming funds to the attacker's address. Etherscan records cited in the review show 167,464 ether moving from Binance 14 at 20:24 UTC, followed by 28,005.6 ether from Binance 16, both into the attacker's wallet, and nearly 15 minutes later 195,460 ether, worth around $442 million, sent to a second address. The reserve consequence is measurable. On October 1, Binance held exactly enough ether to cover customer balances, a 100 percent reserve ratio, and 108.26 percent of customers' USDC. The roughly 204,500 ether taken represents approximately 5.6 percent of Binance's ether reserves, leaving Binance's ether backing near 94 percent until the exchange replaces what was taken. The attacker's smaller positions, including ENA, UNI, PEPE and AAVE, represent anywhere from 7 percent to 15 percent of Binance's reported holdings of each. Those are CoinDesk's calculations from Binance's own October 1 data, not Binance's current figures, and customer balances will have moved since October 1, so the percentages are an illustration of the gap, not a live reserve ratio. But they explain the logic of the buyback precisely: Binance has to restore the backing token by token, because its monthly proof-of-reserves snapshot compares holdings and customer balances asset by asset, and the stolen wallets were part of the backing itself. Yi He's statement that user funds are safe means, in practice, that customers' balances will be honored even though assets behind them were stolen, and founder Changpeng Zhao has said he expects users to be fully recovered. The buyback is how that expectation gets turned into verifiable reserves.

What is still unresolved

Several questions remain open even after the reserve announcement, and readers should keep them separate from what Binance has now confirmed. First, no timetable: Binance has not said when the purchases will finish, when the updated proof of reserves will be published, or whether withdrawals will resume before or after the buyback completes. The withdrawal track from earlier on October 30 still stands on its own terms, with Binance saying it remained on track to resume withdrawals in about 45 hours from its 08:47 UTC update, pointing to approximately 05:47 UTC on November 1 by CryptoTimes' arithmetic, but that endpoint is an outlet's calculation, not a confirmed reopening time, and Binance has given no schedule by network or asset. Second, the frozen total is unchanged at about $3 billion, and Binance has not said how much of the frozen amount it expects to recover versus write off against the reserve. Third, attribution remains Binance's own open question: Binance has not attributed the attack to any individual or group, even as TRM Labs attributes it to North Korea's TraderTraitor with high confidence and Chainalysis has corroborated that link, as MABOnChain reported earlier on October 30. Fourth, a separate report's headline names the FBI and the United States Secret Service as joining the probe, but that report's own text says Binance's statement does not name either agency, so this article does not treat law-enforcement participation beyond Binance's stated coordination with law enforcement as confirmed. Fifth, Chainalysis said on October 30 that the attackers may be automating the laundering of stolen funds, observing thousands of transactions in a short period with funds repeatedly circulating among addresses, sometimes returning to wallets used earlier in the sequence, which it called never-seen-before laundering patterns. That is Chainalysis' observation, not a confirmed laundering outcome, and it sits alongside the freeze efforts rather than replacing them. Until Binance publishes its updated proof of reserves, confirms the buyback is complete, and confirms withdrawals have begun resuming, the confirmed position is this: more than $6.34 billion reserved in company funds, $5 billion of it already held in the affected tokens, the rest being bought token for token through over-the-counter and on-exchange trades, about $3 billion frozen outside the reserve, and a proof-of-reserves gap that the buyback is designed to close. Until withdrawals actually begin resuming, customers should treat any message offering to unlock withdrawals for a fee, or asking for account details through an unofficial link, as a scam, and rely only on Binance's official channels.

This article is news reporting and is not investment advice.

Sources

• Binance, statement on X, October 30, 2026 (as reported by CoinTelegraph's live blog, Crypto Briefing and Unchained), primary source for the more than $6.34 billion company-funds reserve, $5 billion already held in the affected tokens, purchases through market and over-the-counter transactions, the low-liquidity and settlement-time warning, the exclusion of frozen or protected assets, about $3 billion frozen, company resources covering any confirmed shortfall, and public verification through proof of reserves
• CoinTelegraph, Live Updates: Binance Losses Estimated at $6.3B amid Major Crypto Hack (live blog, entries timed 10:55 UTC and 11:07 UTC, October 30, 2026), primary carrier for the $6.34 billion reserve statement and Yi He's statement that Binance is buying altcoins in quantities matching those stolen through over-the-counter deals and on exchanges, with SAFU and company holdings including substantial bitcoin and ether, and another update promised once purchases are complete
• Crypto Briefing, Binance reserves $6.3B to cover losses from biggest-ever crypto hack (published October 30, 2026), secondary source for the more than $6.3 billion company-funds pledge, $5 billion already held in the affected tokens, the remaining amount acquired through open-market and over-the-counter purchases, the low-liquidity and settlement warning, SAFU's July 2018 launch and approximately $1 billion holdings as of February 2026, and Yi He's fully matching amounts quote
• Unchained, Binance Pegs Hot-Wallet Losses at $6.3 Billion, Vows to Cover Them as TRM Points to North Korea (published October 30, 2026, updated 11:07 UTC), secondary source for the $6.3 billion impact estimate, the 10:55 UTC reserve statement with $5 billion already held in the stolen tokens, Yi He's fully matching amounts statement, and proof-of-reserves verification of user funds
• CryptoNews, Binance hack drained wallets backing customer assets, reserve data shows (published October 30, 2026), secondary source for the CoinDesk review of Binance's reserve data, the Binance 14 wallet's October 1 holdings, the EIP-7702 sweeper mechanism, the ether movement figures, the 100 percent ether and 108.26 percent USDC reserve ratios on October 1, and the estimated 94 percent ether backing after the theft
• Chainalysis, laundering note on X, October 30, 2026 (as reported by CoinTelegraph's live blog, entry timed 10:09 UTC), secondary source for the observation of possible automated laundering, thousands of transactions in a short period, and funds repeatedly circulating among addresses
• MABOnChain, Binance Finds Additional Breach Points in $6.3B Hack (October 30, 2026), context for the additional points of breach, the 45-hour withdrawal track, about $3 billion frozen, and Binance not attributing the attack
• MABOnChain, Binance Expects to Begin Resuming Withdrawals Within 48 Hours (October 30, 2026), context for Yi He's 48-hour timeline, deposits operating normally, and the absence of a schedule by network or asset
• MABOnChain, TRM Labs Blames North Korea for $6.36B Binance Hack (October 30, 2026), context for the TRM attribution, the $6.36 billion traced total, and the frozen stablecoin totals