Binance claims it has already replenished 90% of the assets stolen from its customers in the $6.3 billion cyber theft. The exchange also intends to cover the remaining 10%, but notes that completion will take more time because it involves tokens with lower liquidity.
The company's stance is particularly relevant for those who still cannot freely access their funds: withdrawals remain suspended. In an update posted on X, Binance indicated that it is still on track to reactivate them on Sunday, November 1, 2026, adding that further details will be communicated once confirmed.
The financial scale of the case makes the announcement especially delicate. A $6.3 billion theft puts the incident on an exceptional scale for the cryptocurrency sector, where trust in an intermediary depends not only on the technical protection of its systems, but also on its ability to ensure user operations when emergency measures block deposits or outgoing transfers.
The coverage promised by Binance
According to statements made by the CEO of Binance, the majority of the stolen assets have been “replenished,” meaning restored to the availability needed to compensate affected users. In the company's account, this does not necessarily involve funds recovered from the attackers: Binance claims it is directly absorbing the financial impact of the theft.
The distinction matters. For a customer, the expected concrete outcome is that the stolen balance is made whole; for the exchange, directly undertaking compensation means having the assets or equivalent value on hand to do so, regardless of the outcome of recovery efforts. However, the available information does not specify the mechanisms used to execute this replenishment, nor the breakdown across the various affected cryptocurrencies.
The 10% not yet covered reportedly consists of tokens described as less liquid. In practical terms, these are assets for which purchasing or quickly sourcing significant quantities can be more difficult, or can result in less favorable market conditions. Binance has not indicated which tokens fall into this category, nor has it provided a deadline for fully restoring that portion.
The commitment communicated by the company is nevertheless to fully absorb the losses resulting from the incident. In a message released by the firm, Binance reiterated that it will cover the financial impact of the stolen funds “fully” and promised transparent and verifiable updates on the work underway.
Why withdrawals remain the decisive step
The replenishment of funds and the resumption of withdrawals are two connected, yet distinct matters. The former concerns the operator’s ability to ensure that users do not bear the financial loss; the latter involves the actual ability to move assets off the platform. As long as the feature remains suspended, the most direct verification for customers remains on hold.
Binance has set its next milestone precisely on the resumption of withdrawal services. The date indicated is Sunday, November 1, 2026, but the phrasing used by the company refers to a target still “on track” with the announced timeline, rather than an already completed reactivation. For this reason, the deadline should be viewed as an operational forecast, pending final confirmation.
In a security incident of this scale, keeping withdrawals frozen can help contain immediate consequences and allow for system checks. At the same time, prolonged downtime increases uncertainty for individuals needing to use or transfer their holdings. Reopening will therefore be the step that transforms the stated commitment into a tangibly verifiable experience for users.
The missing information
The communications reported so far clarify the financial position adopted by Binance, but leave several core elements of the incident open. The available material provides no details regarding the attack vector, the exact time it occurred, the systems involved, or the identity of the attackers. Nor does any detailed procedure emerge for crediting funds to users, beyond the general guarantee of coverage.
This limits the ability to externally assess both the origin of the compromise and the measures taken to prevent it from recurring. An update on the covered amount helps clarify customers' immediate exposure, but it does not replace a technical account of what happened. For a platform that manages digital assets on behalf of third parties, these two aspects remain inevitably intertwined: reimbursement protects against financial harm, while an explanation of the incident concerns future trust in the infrastructure.
It also remains to be seen whether the resumption of withdrawals will occur for all assets and all users simultaneously, or with potential limitations. Binance did not provide these specifics in the cited update. The presence of less liquid tokens among the funds still to be covered suggests that conditions may not be identical for every asset, but at the moment there are no details available to confirm this.
What to watch in the coming hours
Binance's next update will primarily need to confirm or deny the reactivation of withdrawals scheduled for November 1. In parallel, it will be important to see whether the exchange shares progress on the remaining 10% and releases more specific information regarding the tokens involved and the compensation procedures.
For customers, the immediate priority remains the actual availability of their assets. For the market, a case of this magnitude draws attention to the operational risk concentrated within large centralized platforms: even when an operator claims it can absorb the losses, the suspension of services demonstrates how security, liquidity, and continuity of access are inseparable components of cryptocurrency custody.
At present, the most concrete fact is Binance's stated commitment: 90% of the stolen funds have reportedly been restored, the rest will be covered by the company, and the resumption of withdrawals is expected by Sunday. The definitive verification will come with the actual reopening of the service and the publication of further details about the incident.
