on October 29, attackers compromised Binance's hot-wallet infrastructure and executed unauthorised withdrawals worth approximately $6.3B across multiple blockchains.

Binance's initial investigation pointed to a potentially compromised employee laptop, although further investigation uncovered additional points of breach. The exchange said it found no evidence that wallet private keys had been leaked.

here's how recovery unfolded:

$3B: approximately this amount of affected assets was frozen on-chain through cooperation with issuers, exchanges and law enforcement.

95%: Binance says it has replenished approximately 95% of the affected assets using company funds, SAFU and a portion of its Futures Insurance Fund.

5% remaining: less-liquid tokens that take longer to source through market purchases and OTC deals.

withdrawals have since resumed in phases, with major assets including BTC, ETH, BNB, SOL, USDT and USDC among those restored.

there's one distinction worth understanding: 95% replenished does not mean 95% of the stolen funds have been recovered. Binance is replacing the affected assets so customer balances remain backed, while efforts to trace and recover the original stolen funds continue.

the exchange has also published updated Proof of Reserves data, with full cryptographic verification for the major affected assets being prepared.

the real test now is completing the remaining replenishment, maintaining withdrawal access and demonstrating that customer assets remain fully backed.