Binance Targets Withdrawal Restart Within 34 Hours After $6.3 Billion Hack

Binance has set out a timetable for restoring withdrawals after one of the largest hacks in cryptocurrency history, targeting an initial phased reopening within about 34 hours, according to its second security update published on October 30. The plan marks a critical moment for the world’s largest cryptocurrency exchange by trading volume, because the ability of customers to withdraw their funds is the most direct test of an exchange’s solvency, security, and operational resilience after a major breach. For millions of users who have watched the incident unfold since October 29, the timetable provides the first concrete indication of when normal service might begin to return, even though Binance has stressed that the reopening remains subject to security reviews and could change if those reviews uncover further issues.

The timeline was described in slightly different terms by different parts of Binance’s communications, a detail that matters for users trying to plan around it. The written update pointed to a target of within about 34 hours for the initial phased reopening, while a video message from co-chief executive Richard Teng referred to a target of within about 40 hours, before Sunday, November 1. The difference likely reflects the time at which each message was prepared and the phased nature of the restart, rather than a contradiction about the underlying plan, but it underlines why users should follow Binance’s official channels for the latest timing rather than treating any single figure as a fixed deadline. A phased reopening also means that not all withdrawals will necessarily become available at once. Exchanges typically restore services gradually after a security incident, starting with a limited set of assets or withdrawal types, monitoring systems closely, and expanding access only if no further problems emerge.

Alongside the withdrawal timetable, Binance committed to publishing its first Proof of Reserves snapshot within 12 hours, with results expected by Monday, November 2. Proof of Reserves is a mechanism by which an exchange seeks to demonstrate that it holds sufficient assets to cover customer balances, usually through a combination of wallet attestations and independent verification. The concept gained prominence after the collapse of FTX in 2022, when customers discovered that an exchange they trusted did not hold the assets it claimed. For Binance, publishing a fresh snapshot so quickly after a major hack is therefore both a transparency measure and a confidence-building exercise. It will allow users, analysts, and independent observers to check the exchange’s stated holdings against its liabilities, although the value of any such snapshot depends on its scope, methodology, and the independence of its verification.

The scale of the loss and how Binance plans to cover it

The attack, which began at about 20:05 coordinated universal time on October 29, involved approximately $6.3 billion in stolen funds, making it the largest hack on record in the cryptocurrency industry by value. That scale alone explains why the incident has dominated market sentiment and raised questions far beyond Binance itself. A loss of that size tests even the largest exchange’s balance sheet, its insurance arrangements, and its ability to maintain customer confidence while investigations continue. It also raises broader questions about the security of centralised exchanges, which hold large concentrations of customer assets in hot wallets connected to the internet and in cold storage systems that are supposed to be offline and harder to compromise.

Binance said it has set aside more than $6.34 billion in company funds, drawn from its Secure Asset Fund for Users, known as SAFU, and from its treasury, to cover the losses. More than $5 billion in matching assets is already in place, with about 80 percent of the stolen funds already replenished, and the remainder to be covered through market purchases and over-the-counter transactions. Those figures, if accurate, suggest that Binance entered the incident with substantial reserves and has been able to move quickly to replace a large share of the stolen value. The use of market and over-the-counter purchases to complete the replenishment is also significant, because buying large quantities of cryptocurrencies on open markets could itself move prices, while over-the-counter deals allow large transactions to be executed privately without directly impacting exchange order books.

In parallel with its own replenishment efforts, Binance reported that about $3 billion in stolen funds has been frozen, including more than $1.5 billion in USDT frozen by Tether and more than $800 million in USDC frozen by Circle. Freezing stolen stablecoins is one of the few direct levers available after a theft, because the issuers of centralised stablecoins can blacklist addresses associated with illicit activity and prevent those tokens from being redeemed or transferred through compliant venues. That capability is controversial in decentralised finance circles, where it is seen as a form of centralised control, but in the context of a major theft it provides a practical means of limiting the attacker’s ability to cash out. The frozen total represents a substantial share of the stolen amount, although it does not by itself return funds to Binance or its customers, and the legal and technical process for recovering frozen assets can be lengthy.

What investigators have found so far

Co-chief executive Richard Teng also cited EIP-7702 delegation in connection with the incident. EIP-7702 is an Ethereum improvement proposal that allows externally owned accounts, the standard type of user wallet, to temporarily delegate control to smart contract code, enabling features such as batched transactions and sponsored gas fees. That functionality, while useful, also creates new risks if delegation is abused or if users are tricked into delegating to malicious contracts. The precise role of EIP-7702 delegation in the Binance incident has not been fully detailed in the public updates summarised here, and readers should be cautious about drawing firm conclusions until Binance publishes its technical findings. Those findings are expected within about 48 hours, according to the update, and will be closely watched by security researchers, other exchanges, and regulators seeking to understand whether the attack exploited a novel technique or a combination of more familiar weaknesses.

Attribution for the attack remains contested and unconfirmed in official terms. Claims that the attack was carried out by North Korea’s TraderTraitor group have been made by blockchain analytics firms TRM Labs, Chainalysis, and Elliptic, which are known for tracking illicit cryptocurrency flows and attributing them to known threat actors. The Federal Bureau of Investigation is investigating the incident but has not publicly named a perpetrator. That distinction matters. Attribution by private analytics firms, however credible their methods may be, is not the same as a formal attribution by law enforcement or government authorities, which typically requires a higher standard of evidence and may be withheld while investigations are active. Readers should therefore treat the North Korea claim as claimed by those firms, not as confirmed, until official sources provide further information.

Deposits and what happens next

While withdrawals remain paused pending the phased restart, deposits are operating normally after a brief pause, according to Binance. That asymmetry is normal after a security incident, because allowing deposits does not expose the exchange to the same risk as allowing withdrawals while systems are still being checked. Users can move funds onto the platform, but they cannot yet move them off through the normal withdrawal process. For traders who hold positions on Binance, that situation creates a difficult choice. They can continue to trade within the platform, add funds, or wait for withdrawals to reopen, but they cannot currently exit to self-custody or to another venue through a withdrawal. That constraint is one reason why the withdrawal timetable is so closely watched, and why any delay beyond the targeted window could increase anxiety even if Binance’s financial position remains strong.

Frequently asked questions

When will Binance withdrawals reopen?

Binance is targeting an initial phased withdrawal reopening within about 34 hours of its October 30 update, with co-chief executive Richard Teng referring in a video message to within about 40 hours, before Sunday, November 1. The reopening is subject to security reviews, so the timing could change if further issues are found during those checks.

How will Binance cover the $6.3 billion loss?

Binance said it has set aside more than $6.34 billion in company funds from its SAFU fund and treasury to cover losses, with more than $5 billion in matching assets already in place and about 80 percent of stolen funds replenished. The remainder is to be covered through market and over-the-counter purchases, while about $3 billion in stolen funds has been frozen by stablecoin issuers and other parties.

When will proof of reserves be published?

Binance committed to publishing its first Proof of Reserves snapshot within 12 hours of the October 30 update, with results expected by Monday, November 2. The snapshot is intended to demonstrate that the exchange holds sufficient assets to cover customer balances after the hack.

Has North Korea been confirmed as responsible for the hack?

No, attribution to North Korea’s TraderTraitor group has been claimed by blockchain analytics firms TRM Labs, Chainalysis, and Elliptic, but it has not been publicly confirmed by law enforcement. The Federal Bureau of Investigation is investigating the incident but has not publicly named a perpetrator, so the attribution should be treated as claimed, not confirmed.

Source: CryptoBriefing

Related reading on MM Crypto Analysis Web

• Spot Bitcoin ETF Outflows Top $635 Million in Single-Day Reversal
• Spot Bitcoin ETF Explained: How They Work, Fees and Risks
• Ki Young Ju: Bitcoin ETF Flows Near Zero Yet BTC Down Only 7%

More in Bitcoin on MM Crypto Analysis Web.