Frozen Does Not Mean Returned: Binance’s Post-Hack Recovery

Freezing assets

Frozen assets are funds whose movement has been restricted. According to Elliptic’s assessment at the beginning of November 1, approximately $2.85 billion had been frozen or seized in connection with the investigation. That does not mean the entire amount has already been returned to Binance and made available to customers.

Replacing the missing assets

Replenishing losses is a different process. The exchange uses its own resources to replace missing assets without waiting for the stolen funds to be recovered. Binance reported coverage of around 90% of the affected amount on October 31, rising to approximately 95% in its November 1 update. These are company statements about replacing assets, not the percentage of stolen funds recovered from the attackers.

Restoring withdrawals

A third task is restoring customers’ ability to withdraw. Binance’s official account announced the start of a phased resumption, first for BTC and then for other specified assets and networks. That is not the same as restoring every withdrawal route simultaneously.

The reserve snapshot and the proof

Finally, there is Proof of Reserves. Binance reported a snapshot taken on October 31 at 00:00 UTC. The company nevertheless expected the complete zero-knowledge proof by November 3. A published snapshot and the promised completion of the calculations must not be presented as a single, already completed stage.

Reserve verification itself also has limits. The PCAOB’s Office of the Investor Advocate has warned that PoR is not equivalent to a full audit and does not, by itself, establish the effectiveness of internal controls. This is a general warning about such reports, not a separate finding about Binance.

There is therefore no single final figure for this story yet. Recovering stolen funds, replenishing reserves, enabling withdrawals and addressing the cause of the attack are four separate efforts, each with its own evidence and timetable.

Update — November 5, 2026

Binance said it had used its own funds to replace assets representing about 98% of the losses. That does not mean 98% of the stolen assets were returned to the exchange. The new reserve snapshot, taken on November 4, covers 44 tokens, up from ten. At the time of this check, Binance had not announced completion of the full cryptographic proof for the new snapshot. The proof it previously announced as complete was for the October 31 snapshot.

Separately, Binance announced that the next phase of restoring withdrawals would begin at 04:00 UTC on November 5. It covers specific asset–network pairs, not all withdrawal routes at once.