Binance Hack Recovery: Withdrawals Resume After $6.3B Theft

On Sunday, Binance resumed customer withdrawals, four days after hackers stole about $6.3 billion from its hot wallets in the largest crypto theft on record.

Over the weekend, the exchange gradually reopened, beginning with bitcoin and eventually covering 15 networks. This was the first major test of whether the platform could sustain a loss of that size without locking out customers for an extended period.

The recovery effort started on Saturday. In its third update on the recovery, Binance stated it had replenished 90% of the affected amount using company funds. The exchange drew on its Secure Asset Fund for Users, part of its futures insurance fund, and its corporate treasury to buy replacement tokens.

The use of the futures fund attracted particular scrutiny because Binance described the remaining balance as a regulatory requirement. Binance also published a new proof-of-reserves snapshot from October 31, giving users a baseline to verify their holdings.

Sunday's reopening began at 06:00 UTC with BTC. Then Binance added ETH, BNB Smart Chain, Solana, XRP, Dogecoin, Tron, Polygon, Avalanche, Arbitrum, Base, Optimism, Zcash, TON, and Sui. Between 06:00 and 15:30 UTC, the exchange processed approximately $4.65 billion in withdrawals against roughly $1.01 billion in deposits.

This resulted in a net outflow of about $3.64 billion, equivalent to 2.1% of the $171 billion in assets Binance reported in its late-October proof of reserves.

Deposits remained open throughout, and the exchange said temporary delays might occur during the initial surge in volume.

Binance said its Sunday update brought coverage to 95% of the impacted amount. The remaining 5% is in less liquid tokens outside the top ten assets on its proof-of-reserves list. Acquiring those tokens at the required scale takes more time, and the exchange said it is working with industry partners and OTC desks to complete the purchases. Binance has committed to covering the full amount and has repeated that users will not bear the financial impact of the theft.

On Monday, Binance said the full zero-knowledge proof for the October 31 snapshot is complete. Holders of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, or ZEC can run the exchange’s verifier to confirm their balances are backed at least 1:1.

The verifier is open source, and the exchange has directed users to a step-by-step guide.

The exchange plans another snapshot covering more tokens on November 4; generating the proof is expected to take 40 to 50 hours. A further withdrawal phase is scheduled for Tuesday, and the exchange said it would share details once the rollout is ready.

Binance hack background

On the law enforcement side, the FBI has attributed the attack to North Korea, and the U.S. Secret Service is working with Circle to trace and freeze funds. Tether reported about $1.57 billion in USDT frozen, and Circle said it had frozen more than $800 million in USDC in coordination with authorities.

The market responded sharply to the breach. Bitcoin fell about 5% to below $77,000 in the hours after the attack, and shares of Coinbase, Robinhood, Strategy, and Strive all declined as investors weighed the risk of exchange-level losses across the sector.

Binance has said it found additional points of breach beyond the initial compromise, which it originally attributed to a single engineer’s laptop. The exchange has not yet published a full post-mortem explaining how the attackers prepared and executed the operation, which some estimates suggest took at least 36 hours of groundwork.

The destination of roughly $3.3 billion in stolen funds that were not frozen has also not been fully explained, and the exchange has not detailed what it expects to recover from that pool. Investigators continue to track wallet activity across ten blockchains.