An exchange lost about $6.3 billion and spent the week counting back up: 80, 90, 95. A hundred appeared too, in a different sentence. Every number was true as stated. The interesting question was never how much. It was: of what?

Last Sunday I wrote about careful words: retired, safe, unaffected.¹ This week the industry put the dictionary down and picked up a calculator.

That is progress, of a kind. A number can be checked in a way an adjective cannot. But a percentage is a fraction with the bottom half hidden, and this week the bottom halves did a great deal of quiet work.

“Approximately 80%”

On Thursday night, by its own account, Binance lost about $6.3 billion when attackers pushed unauthorised withdrawals out of its wallets.² By Friday morning it had a plan, and by Friday evening it had a number.

At 10:55 UTC it said it had reserved more than $6.34 billion of company money, $5 billion of it already in the tokens that were taken.³ At 19:33 UTC, in an update signed by its two co-chief executives, it said that covered “approximately 80%” of the loss, and that it was buying the rest on the market and over the counter.⁴

The careful reader notices that $6.34 billion is more than $6.3 billion, and that it is still only 80%. Both are true.

The first figure is money set aside; the second is how much of the stolen basket, token for token, Binance actually held. If you lost ether, a dollar of something else is not yet your ether.

The denominator, too, was Binance’s own. TRM Labs put the theft at about $6.36 billion and Chainalysis at about $6.4 billion.⁵ The FBI later said “more than $6 billion”.⁶ They are close. They are not the same, and a percentage quietly picks one.

“Fully backed 100%”

On Saturday at 14:24 UTC the figure rose to 90%. The same update said ten tokens, among them BTC, ETH, USDT, SOL and XRP, were “fully backed 100%”.⁷

Read quickly, 90 and 100 seem to argue with each other. They do not, because they answer different questions.

Ninety is about refilling what was stolen. One hundred is about whether customer balances in those ten tokens are matched by reserves, according to a proof-of-reserves snapshot Binance took at midnight. The full zero-knowledge proof, the version a customer can check for themselves, was promised by Tuesday.⁷

Until then, 100% is Binance’s word, accompanied by a snapshot.

One number that afternoon needed no one’s word. At 14:51 UTC, Binance’s public SAFU emergency-fund address sent 7,499 BTC in a single transaction, visible to anyone with a block explorer.⁸ Binance said the transfer was complete. It was the week’s most checkable figure, and it came without a percentage attached.

“95%” and seven of 15

By 04:11 UTC this morning the coverage figure was 95%, with the last 5% in less liquid tokens outside the top ten. “These losses will not be passed on to users,” the update said.⁹ An hour earlier, a separate post had put it in dollars: $6 billion covered.¹⁰

Then the doors began to open. Bitcoin went first. By 10:03 UTC, Binance listed seven of its 15 phase-one networks as reopened: Bitcoin, Ethereum, BNB Smart Chain, XRP, Base, Dogecoin and Optimism.¹¹ Withdrawals now leave from newly generated wallets, which Binance has added to its proof-of-reserves address list.¹²

So on Sunday morning a Binance customer could hold three of the exchange’s percentages at once.

Ninety-five per cent covered. One hundred per cent backed, for ten tokens. And seven of 15 networks open, which is 47% by my arithmetic, a figure Binance did not publish.

Solana sits in the second number and, as of that 10:03 list, outside the third. A customer holding SOL was, on Binance’s account, fully backed and not yet able to withdraw.

None of this is a complaint. Phasing a restart after a theft this size is what a careful operator does, and Binance said it chose the first networks by last week’s user demand. It is only a reminder that a percentage is always the answer to a question somebody else picked.

Incident ledger

  • Binance · about $6.3B taken on 29 Oct (Binance’s figure); attributed by the FBI to North Korea’s TraderTraitor, which the bureau says it has watched converting the assets mostly into ether. Binance says it bears the loss and that about 95% is covered; about $3B frozen on-chain, it says. Withdrawals reopening by network. Our Binance hack report.
  • Aave · the Binance exploiter supplied 60M USDT and borrowed 19,762 WETH before Aave froze markets; LlamaRisk proposed cutting about $3.7B of unused borrow capacity. Aave’s freeze.
  • THORChain · an emergency pause, after an Ethereum reorg caused a double refund, has held up most of the hackers’ swaps, Chainalysis says. The THORChain pause.
  • Threshold / tBTC · minting and redemptions paused for “security maintenance”; Aave froze tBTC with about $136M supplied. No loss reported. Our report.
  • b14g · about 97M CORE withdrawn without authorisation, the project says; about 9M CORE frozen at exchanges; staked bitcoin unaffected. Our report.
  • Premia · about $400,500 taken from Arbitrum option vaults, by Blockaid’s count; Premia has not commented. Our report.
  • Polymarket · trading put in cancel-only mode for about an hour after a third-party script was compromised; affected traders to be fully reimbursed, it says. Our report.
  • Predict.fun / Myriad · about 400,000 USDT taken from Predict.fun users, reimbursement promised; Myriad voided 10 markets after a leaked internal key. Our report.
  • Bloom · about 9,408 SOL, roughly $947,000, from nine users via a third-party module; full reimbursement promised. Our report.
  • Keystone · device-authentication key stolen; 18,835 devices to be destroyed; records of 25,964 buyers taken. No funds reported lost. Our report.
  • Hardware in the supply chain · Singapore police report tampered Ledger devices from some retail stores, with about S$3.5M lost in at least two cases; Trezor calls an implant report on a Safe 5 from a former reseller credible. Singapore’s warning · Trezor’s alert.
  • DeFi front ends · at least a dozen sites, including Flap and Kintsu, served a wallet drainer after domain hijacks, Blockaid says. Our alert.
  • Data, not coins · Chainalysis says an intruder using agentic techniques reached user names and emails; Coinbase says a vendor incident at Amplitude touched customer contact data. Chainalysis · Coinbase.

Running total: not summed. Binance says it bears its own loss, frozen and labelled amounts overlap with what was taken, and several projects have given no figure. Adding them would produce a percentage of nothing in particular.

Elsewhere

  • Israel extradited Alexander Block, formerly Alexander Gurevich, to the United States over the alleged theft of about $2.8 million from the Nomad bridge in 2022. He is charged, not convicted, and presumed innocent: the Nomad extradition.
  • Coinbase shares fell about 13% on Friday, the morning after third-quarter results, as the Binance hack weighed on the sector: Coinbase’s Friday.
  • Bitcoin closed October 7.3% lower, a percentage with an honest denominator: the month’s open. Sunday’s First Print.

Close

Eighty, ninety, ninety-five, a hundred. Each was published in good order, each was true as stated, and each measured something slightly different from the one before.

I prefer this to last week’s adjectives. Numbers invite checking, and Tuesday’s proof will let customers do some of it themselves.

Next week, when someone gives you a percentage, ask for the bottom half.

See you next Sunday. — L.C.

Footnotes

  1. The Careful Words Week, 25 Oct.
  2. Binance preliminary findings, 30 Oct; see our Binance hack report.
  3. Binance on X, 30 Oct, 10:55 UTC.
  4. Binance security incident update #2, 30 Oct, 19:33 UTC.
  5. As reported by Decrypt, 30 Oct.
  6. FBI cyber alert, 31 Oct; see the FBI’s attribution. North Korea has previously denied hacking allegations.
  7. Binance Recovery Update #3, 31 Oct, 14:24 UTC; see Binance’s 90% update. The ten tokens: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.
  8. mempool.space, block 973,984; Binance said at 16:15 UTC that the SAFU transfer was complete.
  9. Binance Recovery Update #4, 1 Nov, 04:11 UTC.
  10. Binance on X, 1 Nov, 03:04 UTC.
  11. Binance on X, 1 Nov, 10:03 UTC; see Binance’s reopening.
  12. Binance on X, 1 Nov, 06:53 UTC.

References

  • Binance on X, 30 Oct 2026. https://x.com/binance/status/2116121748555153621
  • Binance, security incident update #2, 30 Oct 2026. https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751
  • Binance, Recovery Update #3, 31 Oct 2026. https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62
  • Binance on X, 1 Nov 2026. https://x.com/binance/status/2116728061765034338, https://x.com/binance/status/2116744986096292263, https://x.com/binance/status/2116785774540787920 and https://x.com/binance/status/2116833451949306221
  • Decrypt, TRM and Chainalysis tie $6.4B Binance hack to North Korea’s TraderTraitor, 30 Oct 2026. https://decrypt.co/382224/trm-and-chainalysis-tie-6-4b-binance-hack-to-north-koreas-tradertraitor
  • FBI, North Korea Responsible for $6 Billion+ Binance Attack, 31 Oct 2026. https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack
  • mempool.space, SAFU transaction, 31 Oct 2026. https://mempool.space/tx/774fcb97827d7ed2389447cc3ef3e1abcd024574cd745d2182cc0ec58e7914bd

This article is for information only and is not investment advice.