Binance's pledge to absorb the consequences of its hack addresses who intends to pay for the damage. It does not yet answer two other questions: whether the attack mechanism has been eliminated and whether customers can access their assets when they need them. Restoring trust depends on all three conditions, not just the size of the announced coverage.
Facts and statements reviewed as of 00:58 Baku time on 31 October 2026.
In its incident statement, Binance estimated the stolen assets at approximately $6.3bn and pledged to cover the loss through SAFU and corporate funds. It dated the start of the hot-wallet compromise to 20:05 UTC on 29 October, or 00:05 on 30 October in Baku.
Our analysis separates three processes that cannot substitute for one another: replenishing company assets, recovering stolen funds and safely executing customer transactions. Each has its own timetable, risks and verification requirements.
The control failure extends beyond the question of leaked keys
The most consequential technical acknowledgment appears in Richard Teng's explanation: the wallet delegation bypassed Binance's normal approval procedures. The initial compromised-laptop hypothesis was subsequently supplemented by additional breach points. This remains the company's account, not a completed independent forensic assessment.
The Ethereum standard EIP-7702 cited by Teng allows an account to delegate execution to smart-contract code through a signed authorization. That delegation persists until changed or revoked. Controls therefore need to assess not only individual transfers but also permissions that alter how assets can be controlled.
The distinction matters: a signature accepted by a blockchain does not demonstrate that the legitimate owner approved an operation under its internal rules. Protecting a key and protecting the process that uses it are different tasks. Even without copying the secret itself, malicious use of signing infrastructure can result in an unwanted operation being executed.
Binance said it had found no evidence so far of private keys being leaked. That does not resolve the root-cause question. A substantive technical report needs to establish which approvals were bypassed, what restrictions operated independently of the signing system and why they did not stop the delegation. Infrastructure changes become a demonstrated remedy only after those controls are tested.
Earmarking value is not the same as holding the required tokens
Teng's statement gives two figures: more than $6.34bn in earmarked corporate funds, and $5bn already held in the affected tokens. Binance is acquiring the remaining assets through market and over-the-counter transactions.
Recalculating those rounded figures gives approximately 79%: $5bn relative to a $6.34bn reference. The arithmetic difference is about $1.34bn. This indicates the approximate scale of the remaining asset-composition adjustment against that reference, not an established funding shortfall. Funding may have been earmarked while still being held in other instruments.
Composition matters to customers. An obligation to deliver one ETH is not automatically fulfilled by holding its dollar equivalent in a different asset. Until conversion is complete, price, market depth and execution risks remain. A single aggregate dollar figure cannot establish readiness to process withdrawals of every individual token.
The next substantive test is to compare available token quantities with obligations denominated in the same tokens. Ownership, encumbrances and possible double counting across coverage commitments require separate scrutiny. Public aggregate figures do not replace that reconciliation.
$3bn frozen does not mean $3bn returned
In the same update, Binance reported that approximately $3bn had been frozen. That is about 48% of its $6.3bn theft estimate. Freezing restricts access to assets; it does not establish that the exchange has received them back.
To illustrate the financial distinction, we calculated three conditional scenarios. Only the proportion recovered from the announced frozen pool changes.
| Share of frozen $3bn returned | Amount returned | Theft not offset by this return |
|---|---|---|
| 0% | 0 | 6.3 |
| 50% | 1.5 | 4.8 |
| 100% | 3.0 | 3.3 |
Calculated from Binance's rounded statements at unchanged reference dollar values. Excludes other recoveries, price changes, expenses and service-disruption effects. These are not forecasts, verified balances or estimates of the final accounting loss.
Even recovery of the entire announced frozen pool leaves $3.3bn of the theft not offset by that particular recovery. Recovery of other assets could reduce the remainder. Corporate funding serves a different purpose: it can replenish backing without waiting for recovery proceedings to finish.
The $6.34bn earmark and the $3bn frozen pool therefore cannot be added together as an already available reserve. The first describes announced replacement funding; the second depends on actual recovery and its conditions. Adding them would overstate the funds presently available for use.
The consequences extend beyond a single exchange
The Arbitrum Security Council reported an emergency action freezing 8,425 ETH and approximately 74.56 million ARB associated with the attack. Moving those funds requires an ArbitrumDAO governance decision. This illustrates the distinction between ending an attacker's control and returning assets to the affected party.
A different mechanism appears in risk service provider LlamaRisk's report on the Aave forum. As of its 01:00 UTC update on 30 October, a wallet linked to the attacker had supplied 60 million USDT and borrowed 19,762 WETH. New supply and borrowing were subsequently frozen on affected markets; repayments, withdrawals and liquidations continued. That is neither confiscation of the collateral nor its return to Binance.
Both episodes show how an incident at a centralized exchange becomes a problem for wider financial infrastructure. Networks, lending protocols and governance mechanisms that did not custody Binance customers' funds must respond. The ability to halt operations reduces one risk but introduces dependence on the process for lifting restrictions and determining what happens to the assets.
Resilience therefore cannot be judged solely by the speed of an emergency freeze. The authority to act, the verifiability of the decision and clear conditions for returning to normal operations matter just as much. Otherwise the effectiveness of protection cannot be separated from uncertainty for other participants.
Proof of reserves is necessary but not sufficient
Binance's Proof of Reserves methodology allows checks on the inclusion of customer balances and their backing at a particular point in time. After a major theft, such a report matters because it replaces a general assurance of safety with specific information that can be examined.
The test has limits. In a 27 July 2023 investor bulletin, SEC staff warned that Proof of Reserves is not equivalent to a financial-statement audit and may not reveal the full picture of liabilities. This is general guidance about the method, not a finding about Binance's current financial condition.
Our analysis requires three separate demonstrations. First, the stated assets exist and have been reconciled with obligations. Second, they are available to execute customer withdrawals. Third, the system authorizing their use no longer reproduces the identified compromise scenario. A balance snapshot does not replace testing the second and third conditions.
The opposite error must also be avoided: a hack or a temporary withdrawal suspension does not itself establish insolvency. Such a conclusion requires information on total assets, liabilities and available liquidity that the published statements do not provide.
Execution, not just commitments, must be verified
Binance promises Proof of Reserves results by 2 November and makes the withdrawal restart conditional on security checks. In its 30 October update, withdrawals remained suspended while deposits operated. Announced plans do not establish that recovery has occurred.
For users and businesses in Azerbaijan, the practical risk is not limited to a possible reduction in account balances. If an exchange is used to hold operating funds or make payments, temporary loss of access can disrupt a payment schedule even if the assets ultimately remain intact. Preservation and availability need to be assessed separately.
Substantive signs of recovery would include token-by-token reconciliation of assets and obligations, withdrawals that actually work, and a technical report testing the repaired approval procedures. Assessing the consequences also requires separating direct theft from associated costs and service-disruption losses: a commitment to cover the former should not automatically be extended to the latter.
Our conclusion is that the ability to absorb a substantial loss is a financial resource, not proof that the cause of the hack has been removed. Trust returns when both the existence of funds and the ability to handle them safely are demonstrated. The announced coverage is the start of that verification, not its outcome.
Cover: an AI-generated editorial illustration by FinFly.news.
