How to Read an Exchange’s “We Have Covered the Losses” Statement: Five Checks Before You Trust It — Scored on Binance’s 90%–95% Claim After the $6.3 Billion Theft (Field Guide #72)

When an exchange is hacked, the first question customers ask is “is my money safe?”, and the first answer is nearly always some version of “customers will not bear the losses.” On Sunday 1 November Binance gave the largest version of that answer yet. It said it had replaced about 90%–95% of the roughly $6.3 billion stolen, would reopen withdrawals in phases, and would absorb the impact from its own revenue (The National; Investing.com). That is a reassuring sentence. This guide, Field Guide #72 in our series, shows how to test any sentence of that kind with five checks, and scores Binance’s statement against them as of 07:05 UTC on 1 November 2026.

Why the sentence needs testing

A claim that losses are covered mixes four different statements: that a hole of a certain size existed, that someone has filled part of it, that the filling came from money that was not the customers’, and that the hole cannot reopen. A company can be truthful about one and silent about the others. History shows the range. The table below lists outcomes from earlier large exchange thefts. The size and attribution of the Bybit theft come from the FBI notice; every “what customers got” entry and the other rows are from our memory of public accounts and were not re-checked for this article.

The lesson is that “covered” has meant very different things, from a full refund to a decade-long queue. The five checks below are how to tell which one you are being offered.

Check 1: The denominator. Ninety or ninety-five percent of what?

A coverage percentage needs a base: the dollar value of stolen assets, priced at which moment, and counted in which assets. The figures for this theft are already not identical. Binance’s own number is about $6.3 billion; TRM Labs titled its analysis $6.36 billion (TRM Labs). The coverage figure itself moves: The National reports 95%, Investing.com reports “about 90%”, and CNBC’s Saturday headline said 90% (CNBC). The stolen assets included bitcoin, ether, USDT and USDC, so the dollar value of the missing coins changes every hour with prices even when the coin counts do not. Ask for coin counts per asset. Score: partly. A headline total and a rising percentage are given; an itemised list by asset is not in any report we read.

Check 2: Whose money filled the hole?

Replacement money can come from the exchange’s own reserves, its profits, an insurance or emergency fund, an outside investor or loan, or, quietly, from other customers’ balances. Only the first four leave customers whole without leaving someone else short. Binance’s co-chief executive Richard Teng said losses could be covered from crypto holdings built up from operating revenue, and co-chief executive Yi He said annual revenue would be enough to absorb the impact (Investing.com). Binance’s SAFU emergency fund has typically held about $1 billion, only a sixth of the loss, so most of the replacement must have come from the company’s own balance sheet. That is plausible given the reported $135 billion of assets on the platform, but a company cannot prove which pocket the money came from by saying so. Score: not yet. The source is asserted by executives, not shown.

Check 3: Can anyone outside the company verify it?

The strongest evidence is on-chain: the exchange moves replacement coins to publicly known addresses and independent analysts, such as the firms that traced the theft, confirm the balances. The second best is a signed attestation from an accounting firm that lists assets and customer liabilities on the same date; our Field Guide #71 covers how to read one. The weakest is a press statement. We found no report that cites addresses, an analyst’s confirmation or an auditor for the coverage claim, and none of the articles we read mentions a reserves report, although we had flagged one as expected on Monday 2 November. Score: not yet. This is the check most likely to change within days.

Check 4: What is still missing, and what does the reopening order say?

A statement that 90% or 95% is covered implies 5%–10% is not. At a $6.3 billion theft that is $315 million to $630 million, a size that would be a major hack by itself in most years. The National says the remaining 5% is less liquid assets that may take longer to source. Binance is also reopening in phases and, according to Investing.com, is ordering coins by customer withdrawal demand over the previous week. That order matters: a company that has everything it needs would normally reopen everything. A phased approach is consistent with caution about security, with a liquidity gap, or with both, and the reports do not say which. Score: partly. The gap and the order are disclosed; their cause is not.

Check 5: Is the hole closed?

Covering a loss does not stop the next one. The two explanations for the break-in remain unresolved: Binance has said it is looking at a possibly compromised software engineer’s laptop and has found no evidence that wallet keys were exposed, while Blockaid had said a hot-wallet key was involved (our first report). The FBI says the attackers are converting the proceeds into ether and expects more laundering (The National), so the funds are unlikely to be recovered quickly. Until a post-mortem explains the entry point and what has changed, reopening is a bet that the fix is complete. Score: not yet.

Video: Cointelegraph on the Binance theft and what could happen next, published 30 October 2026.

What this does and does not tell you

A 0-clean score is not an accusation. Several of these checks can only be passed days or weeks after an event, and a strong exchange could pass all five. The score is a way to separate what is known from what is claimed on the day. If the on-chain addresses, a third-party confirmation and a post-mortem arrive, we will rescore. The opposite also holds: a confident statement with all five checks passed would still not make a bank-style deposit guarantee, because exchange balances are not insured the way bank deposits are.

What people do while they wait

This is general information, not advice. Holders who keep coins on an exchange sometimes choose to move part or all of them to their own wallet, and a hack is a common trigger. If so, several habits reduce the risk of a second mistake. Send a small test amount first and confirm it arrives. Type or scan the receiving address and check the first and last characters on the device screen. Be wary of email, text and social-media messages about “withdrawal reopening”: phishing messages tend to follow every major hack. Do not enter your recovery phrase into any website or app; a genuine wallet only asks for it when you restore it. Phased reopening may also mean a particular coin or network is unavailable for hours or days, and fees can rise when many people withdraw at once. For a hardware wallet, buy from the maker and follow our tamper-check guide; for the regulatory backdrop on who may hold client coins, see the SEC custody proposal. Self-custody has its own risks, mainly losing the recovery phrase, so it is a trade rather than a free fix.

Video: The CryptoDad’s live Q&A on the Binance theft and a hardware-wallet warning, published 31 October 2026.

Checklist to copy

• Get the base: dollars, date and assets behind any percentage.
• Ask whose money filled the hole and where it is shown.
• Look for addresses, an auditor or an independent analyst, not only a statement.
• Note what is still missing and why coins reopen in a given order.
• Wait for the post-mortem; “covered” is not “fixed”.

Sources: The National, 1 November, Investing.com, CNBC, TRM Labs, FBI IC3.

Method: bitcoin prices, highs, lows and closes are Coinbase Exchange candles (UTC day) pulled by Bitcoin Mastery at about 07:05 UTC on Sunday 1 November 2026; the 1 November candle is still open at that time, so the “latest” price is the 07:03 UTC ticker (77,844.70) and the last completed daily close is 31 October (77,423.98). Index, gold, yield and long-history bitcoin figures are Yahoo Finance daily closes (US cash-session closes of Friday 30 October). Third-party figures are attributed to their source and date. Scores are our assessment of the public reports available at the time of writing; the historical hack table is from memory and was not re-verified.

Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.