The Core Argument
Binance has told its users that it has replenished roughly 90 percent of the assets stolen in the record 6.3 billion USD hack that forced it to freeze withdrawals, up from 80 percent just a day earlier. The exchange says withdrawal services are resuming in phases, beginning with the Bitcoin network, with each network and asset pair restored only after stability and security checks are completed. On the surface, this reads as a recovery story. Legally, it is the opening chapter of a far more complicated question: what does an exchange owe its customers when nearly 10 percent of a record theft remains uncovered, and who decides how the shortfall is absorbed?
The core argument now taking shape among legal observers is simple. When a custodial exchange holds customer assets, it generally bears the risk of losing them through its own operational failures. A phased reopening of withdrawals does not erase that obligation. It postpones the moment when the accounting has to be settled. If Binance has truly made whole the vast majority of balances, the remaining gap, however small in relative terms, still represents hundreds of millions of dollars in customer funds that must come from somewhere: exchange reserves, profits, insurance arrangements, or future earnings.
Legal Precedents
The cryptocurrency industry offers several sobering precedents. When Mt. Gox collapsed in 2014 after losing hundreds of thousands of bitcoin, users waited more than a decade for a rehabilitation plan, and many received repayments in forms that triggered new tax liabilities. The exchange did not have a deep corporate parent to backstop the losses, and the shortfall fell almost entirely on customers.
More recently, the collapse of FTX showed the opposite dynamic: a bankruptcy estate that, over years, recovered enough value to repay a large share of customer claims, largely because the underlying assets appreciated during the proceedings. The lesson from both cases is that the legal mechanism matters enormously. A solvent exchange that voluntarily replenishes stolen assets, as Binance now claims to be doing, avoids the bankruptcy route entirely and with it the years of litigation that Mt. Gox and FTX claimants endured.
There is also a regulatory layer. The FBI has attributed the hack to North Korean operatives, which places the incident squarely in the territory of federal law enforcement and, potentially, in the crosshairs of the CLARITY Act debate that has already consumed Washington in the days before the midterm elections. Lawmakers who spent the week arguing over whether offshore exchanges need American oversight now have a live example of what happens when they do not have it.
Potential Scenarios
Three scenarios look plausible from here. In the first, Binance completes the replenishment before the phased withdrawal rollout finishes, and the incident becomes a historical footnote about operational resilience, albeit the most expensive footnote in the industry’s history. Users get their funds, and the legal questions fade into the background.
In the second scenario, the final tranche proves harder to cover. The stolen assets that were converted into ether and TRX before stablecoin issuers could freeze them may never be fully recovered, even with law enforcement involved. In that case, the exchange would need to absorb the shortfall itself. A company that reported holding five billion USD in matching tokens as partial cover, and whose chief reassured the public about its balance sheet, has signaled it intends to do exactly that. Whether that commitment survives contact with the final accounting is the question every user should be watching.
In the third scenario, the reopening itself becomes the legal flashpoint. Binance has warned users to expect congestion, longer processing times, and temporary delays during the phased rollout. A wave of failed or delayed withdrawals at the moment confidence is thinnest could trigger the very panic the phased approach was designed to prevent, and with it, a fresh wave of complaints to regulators on three continents.
The Timeline
The sequencing matters legally. The hack struck on Thursday. By Saturday, the exchange said 80 percent of stolen assets had been replenished and committed to resuming withdrawals on Sunday. By Sunday it announced the phased plan and confirmed the 90 percent figure, with the Bitcoin network first in line. That pace, roughly 10 percentage points of a 6.3 billion USD theft restored per day, is without precedent in this industry.
But the timeline also contains a subtle warning. Users were told to check the withdrawal page for their specific asset and network, which means access will arrive unevenly. Tokens were prioritized based on a week of user demand data. From a legal perspective, selective restoration is defensible as a security measure, but it also means that for some users, the freeze continues indefinitely, with no published end date for their particular asset.
Final Outlook
Bitcoin traded near 78,000 USD on Sunday, holding remarkably steady through the entire ordeal, and ether near 2,270 USD. The market, in other words, is pricing in recovery rather than collapse. That confidence rests almost entirely on the exchange’s own statements about replenishment, which have not yet been audited or verified by any independent party.
For everyday users, the practical takeaway is to treat the phased reopening as an opportunity to reassess custody. The surest legal protection ever devised in this industry is not a regulator’s enforcement action but the private key you control yourself. Exchanges remain the most convenient way to trade, and this incident may yet end as a story of resilience rather than ruin. But the 10 percent that is still missing is a reminder that the terms of recovery are written by whoever holds the assets, and read by everyone else.
Disclaimer: This article is for informational purposes only and does not constitute legal, investment, or financial advice. Crypto markets are volatile, and past performance is not indicative of future results. Always do your own research before making financial decisions.
resuming withdrawals on the bitcoin network first is smart pr, safest chain to prove the pipeline works. the real test is when they get to the long tail of small cap tokens nobody has been market making for weeks
Mt. Gox creditors waited over a decade for a rehabilitation plan and then got hit with tax bills on the payout. Anyone expecting the missing 10 percent of that 6.3 billion to settle quickly should reread that chapter.
^ good point on Gox. the FTX estate actually repaid a big share of claims because assets rallied during bankruptcy. binance better hope ETH does the same for that gap
Gox comparison only half applies imo. that was a bankruptcy with a trustee, here the exchange is solvent and still operating, so the shortfall is more like a negotiated rebate fight than a decade in a courtroom
90 percent replenished sounds great until you do the math. 10 percent of 6.3 billion is still 630 million of customer money unaccounted for
its worse than your math even, that 630 million gap is measured against balances at hack time. anyone who would have sold and rebought since then has a completely different claim