Binance Reopens Withdrawals in Phases After $6.3 Billion North Korea Hack
Binance restarted customer withdrawals on Sunday in stages, beginning with bitcoin, four days after a roughly $6.3 billion theft from its hot wallets. The exchange says it has covered 95% of the losses and is working to fund the remaining 5%, which sits in less liquid tokens.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Withdrawals Resume in Stages
Binance reopened customer withdrawals on Sunday at 06:00 UTC, starting with bitcoin and then adding ETH, BNB Smart Chain, Solana, XRP, Dogecoin, Tron, Polygon, Avalanche, Arbitrum, Base, Optimism, Zcash, TON and Sui. The rollout followed a theft of roughly $6.3 billion from the exchange's hot wallets, which Binance and both source reports describe as the largest crypto theft on record. Deposits stayed open throughout.
Between 06:00 and 15:30 UTC on Sunday, the exchange processed about $4.65 billion in withdrawals against roughly $1.01 billion in deposits, a net outflow near $3.64 billion. Bitcoin Magazine calculated that figure at about 2.1% of the $171 billion in assets Binance reported in its late-October proof of reserves. Binance warned that temporary delays were possible during the initial surge in volume.
How the Losses Are Being Covered
Binance said its third recovery update showed 90% of the impacted amount replenished with company funds, drawn from a portion of its Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury. Its Sunday update raised coverage to 95%. The remaining 5% sits in tokens outside the top ten assets on the exchange's proof-of-reserves list, and sourcing them at the required scale is taking longer. Binance says it is working with industry partners and over-the-counter desks, and has committed to covering the full amount so users bear no financial impact.
The futures insurance fund contribution drew attention because Binance described the remaining balance in that fund as a regulatory requirement. The exchange has not published details on how that requirement applies.
Reports differ on how much of the stolen money is accounted for. Binance's figures imply roughly $3.3 billion of the stolen funds were not frozen, and the exchange has not explained what it expects to recover from that pool. Investigators are still tracking wallet activity across ten blockchains.
Proof of Reserves and Verification
On Monday, Binance said the full zero-knowledge proof for its October 31 snapshot was complete. Users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can run the exchange's open-source verifier to confirm their balances are backed at least 1:1. The exchange has published a step-by-step guide.
A further snapshot covering more tokens is planned for November 4, with the proof expected to take 40 to 50 hours to generate. A further withdrawal phase is scheduled for Tuesday, with details to follow once the rollout is ready.
Law Enforcement and Market Response
The FBI has attributed the attack to North Korea. The U.S. Secret Service is working with Circle to trace and freeze funds. Tether reported about $1.57 billion in USDT frozen, and Circle said it had frozen more than $800 million in USDC in coordination with authorities.
Bitcoin fell about 5% to below $77,000 in the hours after the attack, according to Bitcoin Magazine's market reporting. Shares of Coinbase, Robinhood, Strategy and Strive also declined as investors weighed the risk of exchange-level losses across the sector.
Open Questions on the Attack
Binance originally attributed the breach to a single engineer's laptop. It has since said it found additional points of breach beyond that initial compromise. The exchange has not yet published a full post-mortem explaining how the attackers prepared and executed the operation, which some estimates suggest took at least 36 hours of groundwork. Bitcoin Magazine notes that post-mortem reviews will remain open.
Why It Matters
For Traders
Withdrawal availability on Binance is now phased by network, so expect uneven liquidity and possible delays on specific chains during the next rollout on Tuesday.
For Investors
The scale of the loss tests whether a top exchange can absorb a record theft without lasting customer harm, a key factor in custody risk across the sector.
For Builders
Binance's proof-of-reserves verifier is open source and runs on a zero-knowledge proof, giving integrators a concrete model for independently auditable exchange balances.
This article is for information only and is not financial advice. Read the full disclaimer.
