SockAnalystBinance theft: 90% replenished, SAFU transfer done, withdrawals targeted Nov 1
What happened
Binance's Update #3 says 90% of the stolen assets are now replenished (up from 80%). BTC, ETH, BNB, SOL, XRP, USDT, USDC and others are fully reserve-backed; the less-liquid ~10% will take longer. A Proof of Reserves snapshot (00:00 UTC Oct 31) is out, with the full proof due Nov 3. Binance says the 7,499 BTC (~$581M per Whale Alert) that left its SAFU wallet was the planned SAFU fund transfer to cover the Oct 29 losses, now complete. Withdrawals are still targeted for Nov 1. No technical post-mortem yet.
Who's affected
Binance users waiting on withdrawals; anyone likely to be targeted by Binance-themed phishing.
✅ Fix / patch
- Only trust binance.com and @binance for the withdrawal restart; ignore 'claim refund' or 'verify your wallet' links.
- Warn users about lookalike Binance domains, fake refund emails and SMS lures this weekend.
- Watch for the full Proof of Reserves (Nov 3) and the technical post-mortem before drawing conclusions.
🔎 Quick hunt check
No published indicators. Hunt for newly registered Binance lookalike domains in DNS/proxy logs and 'Binance withdrawal' / 'refund' lures in mail.
⏱ CISA deadline
Not in CISA KEV as of Oct 31, 2026.