95% replaced: Binance reopens after $6.3B heist

Binance has replaced 95% of the $6.3 billion stolen in the largest crypto heist on record, and reopened withdrawals in phases starting Sunday. That leaves $315 million still to source — and about $3.3 billion still in the hackers' hands, a gap that frozen funds do not close.

This is a new milestone, not a re-run of the theft itself. Two days ago I did the freeze math on the heist: roughly $3 billion frozen, roughly $3.3 billion unlocated. Today's news is the other side of that ledger — Binance paying to make users whole out of its own pocket, before any of the frozen money is actually recovered.

Here is the replenishment arithmetic, all from Binance's own updates as reported by TechCrunch and Reuters on November 1:

Stolen:            $6.30B
Covered at 95%:    $5.985B  (Reuters rounds this to "$6 billion")
Still to source:   $0.315B  (the illiquid 5%)
Set aside by Binance: $6.34B  ($40M, or 0.6%, above the loss)
Frozen with partners: ~$3.0B  (47.6% of the total)
Still with hackers:   ~$3.3B  (52.4%)
Scale vs Bybit Feb 2025 ($1.5B): 4.2x

The funding stack matters because it shows what "covered" actually means. Per Reuters, the money came from Binance's $1 billion Secure Asset Fund for Users (SAFU), its Futures Insurance Fund, and its corporate treasury — and co-CEO Yi He said 50% of SAFU, or about $500 million, was used, with a commitment to replenish it to about $1 billion. The Wall Street Journal adds a useful split: Binance already held $5 billion of the stolen assets in the same cryptocurrencies, and is buying the remaining $1.3 billion in the market. In other words, most of the "replacement" was inventory Binance already had, not fresh market buying — which is why it could move this fast, and why the last 5% is the slow part: thinly traded tokens that cannot be sourced at scale without moving the price.

The reopening itself is phased, and the status is messier than a single "back online" headline suggests. The first phase covers 15 assets including bitcoin, ether, XRP and dogecoin. Reuters reports bitcoin withdrawals resumed shortly after 0600 GMT on Sunday; TechCrunch, checking Binance's network status page Sunday morning, still saw a mix of normal, partially suspended and fully suspended statuses — bitcoin withdrawals and deposits partially suspended, ether deposits normal with withdrawals partially suspended. Both can be true across a phased rollout in a single morning, which is exactly why "withdrawals resumed" should be read as "withdrawals resuming," with delays Binance itself warns about from traffic volume.

Then there is the attribution, and it needs the same care. The FBI said on Saturday that the North Korean state-sponsored unit TraderTraitor was responsible, and that it observed the group converting stolen assets primarily into ether, with further laundering expected. TraderTraitor was also linked to the $1.5 billion Bybit theft in 2025. But President Trump said on Saturday that the US was still not certain North Korea was involved, and Pyongyang has long denied using state-linked units for financial theft. So the honest framing is: the FBI has attributed it; that attribution is not yet unanimous inside the US government, and Binance has not yet published its own in-depth incident report. How the attackers got in is likewise still open — reports mention a compromised engineer's laptop as one possible entry point, but Binance says its investigation is continuing.

My take: the number to watch now is not the 95%. It is the $3.3 billion that is neither frozen nor recovered, and the $315 million Binance still has to buy. The exchange chose to front the money and try to claw the frozen $3 billion back later — a decision only a balance sheet this large can make, and one that turns a solvency crisis into a recovery operation. If the frozen funds are ever released, Binance gets made whole; if they are not, the loss is already absorbed. For every other exchange watching this, the lesson is uncomfortably concrete: your incident plan is only as good as the liquid inventory you already hold, because the market will not let you buy $6.3 billion of anything in a weekend without noticing.

One question I would put to Binance's promised incident report: which control failed first — the laptop, the wallet signing flow, or the monitoring that let roughly $6.3 billion leave in about 20 minutes? The replenishment math is impressive. It is not an answer to that question.

Sources: TechCrunch, "Binance resumes withdrawals following $6.3 billion breach" (Nov 1, 2026) — https://techcrunch.com/2026/11/01/binance-resumes-withdrawals-following-6-3-billion-breach/ ; Reuters, "Binance resumes bitcoin withdrawals after covering bulk of stolen $6.3 billion" (Nov 1, 2026) — https://www.reuters.com/legal/government/binance-resumes-bitcoin-withdrawals-after-covering-bulk-stolen-63-billion-2026-11-01/ ; Reuters, "Binance to resume withdrawals after recovering bulk of $6 billion in stolen funds" (Nov 1, 2026) — https://www.reuters.com/legal/government/binance-resume-withdrawals-after-recovering-bulk-6-billion-stolen-funds-2026-11-01/ . The arithmetic in the code block is my own computation from those reported figures; the prior freeze-math piece from Oct 30 is https://dev.to/frankchu/binance-lost-63b-in-about-20-minutes-i-did-the-freeze-math-and-half-the-money-is-still-moving-4dkj .