Binance resumes withdrawals in phases after a $6.3 billion hack

Binance has started restoring cryptocurrency withdrawals in phases after a hot-wallet breach on October 29 drained about $6.3 billion. The exchange says it will absorb the loss rather than pass it on to users, and that it has covered about 95% of the financial impact. That 95% is Binance’s replenishment claim. It is not a count of stolen coins that have been recovered.

The reopening is not a blanket restart. Binance said on November 1 that withdrawals would return in phases, by network and asset, and that processing could be slower while traffic is high. A customer still has to check whether the specific asset and network are open.

Binance’s own accounting, quoted by the BBC, shows $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC on November 1. The net outflow of about $3.64 billion was 2.1% of the $171 billion in assets under management on its October 28 reserve data. Binance said the first spike later eased.

Binance says 95% of the impact is covered

On October 30, co-CEO Richard Teng said Binance had set aside more than $6.34 billion, including about $5 billion already held in the affected tokens, and was buying the rest through exchanges and over-the-counter trades.

On October 31, Binance said coverage had reached 90%, up from about 80% in the previous update. It said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed. The money came from a partial use of the Secure Asset Fund for Users, part of the futures insurance fund and the corporate treasury. Binance also said it would refill SAFU to about $1 billion.

The same update said a new proof-of-reserves snapshot was taken at 00:00 UTC on October 31. The full zero-knowledge proof, which lets a holder of those ten assets check that their balance was included, was estimated for November 3 UTC because the calculation takes 40 to 50 hours. Until that proof is published, the coverage percentage is the company’s progress report, not an independent audit.

In its November 1 update, Binance raised the covered share to about 95% and said the remaining 5% consisted of less-liquid tokens outside those ten assets. The BBC quoted that claim. It is still Binance’s account of what it has bought back, not a measure of stolen coins seized from the attackers.

Investigators say Binance’s own systems signed the transfers

Binance first said the intrusion may have started with a compromised engineer’s laptop and that it had found no evidence of a wallet private-key leak. It later said investigators had found more points of entry, and that software designed to erase traces of the attack had hampered the investigation. Teng also said the attackers used Ethereum’s EIP-7702 account-delegation feature to operate a hot wallet outside Binance’s normal approval path.

Bitquery traced about $6.3 billion leaving 17 Binance hot wallets across nine chains between 20:04 and 23:56 UTC on October 29, and said Binance’s own withdrawal system signed the transfers. On Ethereum, it found EIP-7702 authorizations that let attacker-controlled code run on a Binance hot wallet. As of 16:51 UTC on October 31, Bitquery put frozen or rescued assets at about $2.7 billion, mostly locks by Tether, Circle and smaller issuers.

Binance has separately described a freeze of roughly $3 billion with help from token issuers, blockchain companies and law enforcement. Those totals use different methods and times. They should not be added together, and a freeze is not the same as money returned to customers.

Teng said the attack targeted a Binance hot wallet rather than customer balances directly. CoinDesk reported that the compromised wallets had previously appeared on a list of assets backing customer balances. Binance’s promise is that users will not bear the loss. The full technical report is still unpublished.

On October 31, the FBI attributed the theft of more than $6 billion, on or about October 29, to North Korea’s TraderTraitor activity. The bureau said the actors were converting stolen assets primarily into ether and were expected to launder more through decentralised-finance and instant-swap services.

Other exchanges changed their own controls

The same Reuters report said Coinbase adjusted the systems it uses to store cryptocurrency keys offline, and described the change as caution rather than evidence that Coinbase had been breached. Kraken said it was looking at industry incidents for lessons it could apply. OKX chief executive Star Xu called for a real-time alert system so exchanges can share attack information and coordinate freezes of suspected stolen funds.

For Binance customers, the useful checks are narrow. Confirm that the asset and network have actually reopened. Treat the 95% figure as Binance’s claim until the November 3 proof is available to check. And do not read a headline recovery percentage as proof that stolen coins have been seized and put back.