Binance has frozen or intercepted about $2.85 billion in funds connected to the multi-billion-dollar breach it disclosed in late October, according to blockchain analytics firm Elliptic, leaving roughly $3.25 billion still sitting in addresses tied to the incident.
The figure, cited by Elliptic's Tom Robinson, covers only part of the $6.3 billion the exchange says was taken. Binance has set aside $6.34 billion to make affected users whole and has said repeatedly that customers will not absorb the loss.
"Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users," the exchange said in one of its recovery notices.
The disclosure marks the first public accounting of how much of the haul has been contained. It does not specify how much was frozen inside Binance-controlled accounts versus intercepted before a transfer could be completed, nor does it identify which assets are involved. Binance has not published transaction hashes or address-level tracing to support the number.
The FBI has attributed the breach to North Korea's TraderTraitor group, an attribution that Pyongyang has rejected. Kim Yo Jong, a senior North Korean official, has denied the claim.
Insurance fund cut in half
The financial mechanics of the response are visible on-chain. Binance drew down its Secure Asset Fund for Users, the insurance reserve known as SAFU, in two transfers on October 31: one bitcoin at 14:45 UTC, followed six minutes later by 7,499 bitcoin, recorded in blocks 973983 and 973984.
The wallet now holds just over 7,500 bitcoin, down from about 15,000, worth roughly $577 million at a bitcoin price near $77,000. Binance described the outflow as a partial deployment of the reserve to cover hack-related losses.
Note: Bitcoin value calculated at approximately $77,000 per coin.
The exchange has pledged to rebuild SAFU to about $1 billion but has given no timetable. Its own rules call for topping the fund back up when price movements push it below $800 million; that provision does not cover payouts made to cover a breach.
Withdrawals return in stages
Withdrawals, paused after the incident, resumed on November 1 and were widened on November 3 to more than 100 asset-and-network pairs across nine chains, including BNB Smart Chain, Ethereum, Solana, XRP Ledger, SUI, Arbitrum, Optimism, TRON and Base. Deposits stayed open throughout.
"Not all listed assets will become available at once. Like phase one, reopening will roll out progressively across the assets as security and readiness checks are completed," Binance said in its sixth recovery update.
Roughly 95% of affected assets have been replaced, according to the company, which said it is sourcing the remainder, mostly less liquid tokens, through market orders and over-the-counter trades.
A zero-knowledge proof covering the October 31 reserve snapshot also went live, allowing holders of ten major tokens, including bitcoin, ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash, to verify independently that their balances are backed at least one-to-one. The proof wraps a Merkle tree in a zk-SNARK, letting each user confirm inclusion in the snapshot without exposing individual balances. An expanded snapshot covering more tokens is scheduled for November 4, with proof generation expected to take 40 to 50 hours.
A full post-incident technical report is still pending. Until it arrives, the public record consists of balance-sheet commitments and cryptographic attestations rather than an account of how the breach occurred.
Scams follow the disruption
Binance has also warned of a second wave of fraud aimed at users whose balances and withdrawal timelines were thrown into doubt. Two pitches are circulating: offers of paid "priority access" to move a withdrawal to the front of the queue, and fake recovery services in which scammers pose as exchange support and ask for credentials to "verify" an account.
Neither service exists. Binance does not sell queue priority and does not contact customers unprompted to offer recovery help, the company said. Requests for passwords, one-time codes, seed phrases or payments to unlock an account are hallmarks of impersonation.
The pressure is unlikely to ease soon. With $3.25 billion still parked in addresses linked to the breach and no technical post-mortem yet published, the gap between what Binance has contained and what remains traceable is the number the market will watch next.
