After Binance’s pledge to cover losses, restoring trust still depends on assets arriving and withdrawals resuming

Funding preparations have progressed, but recovery remains conditional

Binance’s follow-up announcement, dated October 31, 2026 at the end of the text, says the hot-wallet attack caused approximately $6.3 billion in losses, approximately $3 billion has been frozen on-chain, and recovery efforts continue. The company says it has prepared more than $6.34 billion in company funds and secured corresponding tokens worth more than $5 billion, replenishing approximately 80% of the stolen funds, with the remainder still being purchased. These disclosures provide concrete progress on the replenishment pledge, but they remain company statements and do not establish that compensation is complete. The same announcement says deposits are operating normally while withdrawals remain suspended, with withdrawals to resume in stages by token, subject to security checks. Our assessment is that there are now testable commitments toward restoring trust; whether that process is complete still depends on subsequent asset coverage and actual withdrawals.

Evidence: [2]

Freezing can buy time, but cannot directly establish net losses

A freeze is first a restriction on the use of funds. Circle explains that a blocklisted address can be prevented from sending or receiving the relevant tokens, but Circle cannot reverse or recall transfers that have already been completed. Binance’s disclosed frozen amount therefore cannot be treated directly as returned assets, nor can it simply be deducted from estimated losses to calculate the final compensation shortfall. The legal disposition of frozen assets, the return of assets and the outcome of efforts to recover other funds will still affect final net losses. This is why loss estimates and progress in freezing assets need to be read separately.

Evidence: [6] [2]

The effectiveness of freezing powers depends on asset type and timing

In its investigation based on an early-morning snapshot on October 30, 2026, Bitquery said the attacker had converted approximately $729 million in stolen USDT into ETH, TRX and other assets before the freezes took effect. This observation supports a limited inference: tracing funds does not mean they can still be controlled through the original token’s freezing powers. The restriction powers described by Circle apply to its relevant tokens and cannot be extended to other assets. Freezing can be a response tool, but its effectiveness depends on when action is taken, the form of the assets and subsequent procedures. A single freeze is insufficient to prove that losses have been contained.

Evidence: [4] [6]

Reserve coverage and company capital for compensation must be assessed separately

The approximately $1 billion cited in Binance’s SAFU explanation is a historical asset value as of February 2026. Its value fluctuates with the market, and some of the funds also serve as regulatory capital reserves. That figure alone cannot establish the balance immediately available after the incident. Binance’s proof of reserves, meanwhile, concerns assets held in custody for users and coverage of user balances. It follows that total custodial assets cannot simply be counted as company capital freely available for compensation. Subsequent reserve reports can help assess user-asset coverage, but must still be read alongside the sources of the company’s replenishment funds, whether those funds have actually arrived and any restrictions on their use.

Evidence: [5] [8] [2]

The technical investigation cannot yet be reduced to a single vulnerability

Binance’s initial disclosures included an intrusion into an employee laptop, internal service containers and unauthorized withdrawals. A subsequent announcement said additional intrusion points had been found. TRM assessed that Ethereum EIP-7702 delegation authorizations played a role in the attack, while ordinary transfers with valid signatures appeared on other chains, potentially implicating hot-wallet signing infrastructure spanning multiple chains. This remains the investigators’ technical assessment, rather than a complete postmortem. Binance’s statement that it has so far found no evidence of private-key theft also does not rule out private-key issues. The available clues call for continued examination of authorization and signing processes; the incident cannot be reduced to one confirmed vulnerability.

Evidence: [1] [2] [3]

What evidence should change the assessment

Bitcoin.org distinguishes exchange custody risk from protocol security: users who entrust assets to an exchange depend on that institution’s security and solvency; theft from a company does not mean the Bitcoin protocol has been compromised. This distinction helps define the scope of the incident, but does not prove that platform risk has been resolved. Our assessment places greater weight on whether the commitments are fulfilled: if replenishment of the corresponding assets, reserve coverage and actual withdrawals corroborate one another, there will be stronger grounds for judging that trust in the platform is being restored. If material obstacles arise in securing the funds or resuming withdrawals, the assessment of its recovery capacity should be lowered. New reports and recovery plans remain arrangements set out in the announcement.

Evidence: [7] [8] [2]

What to watch next

• Whether the company completes its disclosed replenishment of the corresponding tokens, and whether the arrival of funds can be further verified.
• Whether withdrawals actually resume for each token, and whether the security-check conditions change.
• Whether subsequent reserve reports clarify the extent of user-asset coverage and corroborate the replenishment disclosures.
• Whether frozen assets are fully returned, and whether recovery progress changes the assessment of final net losses.
• Whether a full technical postmortem explains the multiple intrusion points, signing and authorization issues, and corresponding fixes.