MANILA, Philippines — Philippine crypto asset intermediary BlockShoals Technologies Inc. said Binance has confirmed that no Philippine user personal information was affected by the October 29 security breach, while assuring that customer funds remain safe and that the exchange will absorb the financial losses.

In an updated statement released on November 5, BlockShoals said it had obtained direct confirmation from Binance on matters affecting the Philippine public. Binance also confirmed that all losses resulting from the incident would be covered through its Secure Asset Fund for Users (SAFU) and company funds, according to the statement.

The update comes as Binance continues to replenish assets affected by the breach, restore withdrawal services and strengthen the systems involved in the attack.

BlockShoals said Binance had already replenished approximately 98% of the impacted token assets, with the balances verifiable through its Proof of Reserves (PoR) system. The exchange had also set aside more than 100% of the funds required to cover the losses, it added.

The assurances are significant for the Philippine market, where BlockShoals is working with Binance under the Securities and Exchange Commission’s (SEC) Strategic Sandbox, or StratBox, framework.

However, public onboarding through the arrangement has not yet opened. Binance separately confirmed on November 5 that its services remain unavailable to Filipino users while it and BlockShoals work through regulatory requirements, compliance guidelines and technical integration.

Binance reports 98% replenishment of affected assets

The October 29 incident involved approximately $6.34 billion in digital assets, according to Binance’s November 3 initial findings report.

The exchange said it would absorb the financial impact rather than pass the losses on to customers. It also reported that approximately $2.85 billion in assets had been frozen or intercepted through cooperation with law enforcement, blockchain intelligence firms and industry partners.

In its November 4 Recovery Update #7, Binance said it had replenished approximately 98% of the affected amount using its own resources. The remaining 2% consists of less-liquid tokens that the exchange continues to acquire through market and over-the-counter channels.

Binance said it had set aside more than 100% of the funds required to cover the losses, reiterating that customers would not bear the financial impact.

The exchange’s reported replenishment should be distinguished from the recovery of stolen assets. Replenishment involves acquiring replacement tokens to cover affected balances, while recovery refers to retrieving the cryptocurrency originally taken during the breach.

Binance’s November 3 report separately identified approximately $2.85 billion in assets that had been frozen or intercepted. The amount remains subject to reconciliation and market-price fluctuations.

Proof of Reserves expands to 44 tokens

Binance also expanded the coverage of its Proof of Reserves snapshot following the incident.

In its November 4 update, the exchange said its latest snapshot, taken at 00:00 UTC that day, covered 44 tokens, up from 10 in the previous snapshot.

The snapshot was made available through Binance’s Proof of Reserves page, while the company said generating the complete zero-knowledge proof would take approximately 50 to 60 hours because of the computational workload.

Once generated, users holding any of the covered tokens would be able to independently verify whether their account balances were backed by reserves at a minimum 1:1 ratio, Binance said.

The distinction between the snapshot and the completed proof is important. Binance’s November 4 announcement said the snapshot was available, but the full zero-knowledge verification process was still underway.

Withdrawals resume in additional phases

Binance also continued restoring withdrawal services following the temporary suspension imposed after the breach.

On November 5, the exchange published Recovery Update #8, announcing that withdrawals for additional assets across several blockchain networks would gradually reopen beginning at 12:00 noon Philippine time.

The affected networks include Ethereum, BNB Smart Chain, Base, Tron, Polygon and Sui. Binance said the reopening would take place in batches after security checks for each network and asset combination.

Deposits remained operational, but the exchange cautioned that not all withdrawals would become available simultaneously. It also warned that increased network traffic could cause temporary delays or longer processing times.

The phased restoration follows Binance’s earlier reopening of selected withdrawals on November 1 and subsequent expansion of available assets on November 3.

Binance details security measures following attack

Binance’s November 3 initial findings report described the incident as a multi-stage campaign involving fake recruitment interviews, malicious software, compromised employee devices and access to internal tools.

The exchange said attackers used compromised credentials and an internal AI tool to reach systems connected to wallet operations before executing unauthorized transactions.

In response, Binance said it had closed identified entry points, rebuilt the affected wallet system and internal AI tool, replaced compromised devices, and deactivated credentials and tokens associated with affected employees.

The company also said it had strengthened wallet-service risk controls, expanded AI-based behavioral anomaly detection and completed enhanced security scans across employee devices.

An independent cybersecurity review is also being arranged to assess the incident, validate the company’s findings and recommend additional safeguards. Binance said the investigation remains ongoing.

BlockShoals says it is coordinating with SEC

BlockShoals said protecting users and investors remains central to its role under the SEC’s StratBox framework.

The company added that it is working closely with the SEC on any implications of the security incident for its sandbox project and will keep the Commission informed.

Under the partnership announced in May 2026, BlockShoals serves as the local Crypto Asset Intermediary within the sandbox arrangement, while Binance provides global technology and operational infrastructure. The initiative is intended to test a locally structured digital-asset service under regulatory supervision.

BlockShoals also urged the public to rely on Binance’s official communication channels for incident updates and remain alert to scams, particularly individuals or groups offering to help recover stolen funds.

The company said it would provide further updates as necessary.

‍