USD
Binance Sets Second Withdrawal Phase After $6.3B Hack
Reserve verification expands as the exchange replenishes assets and warns of scams
TL;DR
- Binance scheduled a second phase of crypto withdrawals for Nov. 3 after beginning its phased reopening on Nov. 1.
- The exchange said about 95% of affected assets had been replenished and completed reserve verification for 10 cryptocurrencies.
- Binance also warned that scammers could exploit withdrawal delays through fake support, compensation offers and malicious wallet approvals.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Binance is scheduled to begin a second phase of cryptocurrency withdrawals at 04:00 UTC on Nov. 3 as it continues restoring operations after the $6.3 billion hack. The exchange has replaced about 95% of affected assets and completed a zero-knowledge proof covering 10 cryptocurrencies, while warning customers that fraudsters may try to exploit the phased reopening.
The withdrawal expansion follows the initial reopening on Nov. 1. Binance said the new phase would cover Binance Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base, with tokens prioritized according to user demand over the previous week. Deposits remain available.
“Like phase one, reopening will roll out progressively across the assets as security and readiness checks are completed,” Binance said.
Binance also reopened withdrawals for several fiat currencies on Monday, including the US dollar, United Arab Emirates dirham, Vietnamese dong, Philippine peso and Indonesian rupiah. Those currencies joined 23 others that were already available for withdrawal.
Withdrawals return as exchange outflows slow
DeFiLlama data showed net outflows from Binance slowing after withdrawals began returning. Monday net outflows stood at $2.57 billion, compared with $6.1 billion the previous day. A separate DeFiLlama snapshot put 24-hour net outflows at approximately $3.29 billion, more than 50% below an earlier peak of around $7 billion, while estimating that Binance held approximately $127.78 billion across linked onchain wallets.
The phased reopening followed the Oct. 29 attack, which compromised Binance hot wallets and resulted in approximately $6.3 billion in stolen cryptocurrencies. The theft was described as the largest in cryptocurrency history. Onchain investigators said North Korean attackers exploited Binance’s internal systems and wallet-signing mechanisms to move more than $6 billion across multiple blockchains. The FBI attributed the attack to North Korea on Saturday and identified the hackers as TraderTraitor.
SomaXBT said on Sunday that North Korean hackers had laundered about $242 million of the stolen funds on Tron. StoneX analysts wrote Monday:
“The response from issuers, decentralized finance (DeFi) protocols and Binance itself was faster and better coordinated than anything the industry had previously managed, which we regard as a point of validation for several of the business models we cover, regulated custody most of all.”
Binance replaces assets and draws on SAFU
Binance said approximately 95% of assets affected by the theft had been replenished using company resources, up from 90% a day earlier. The remaining 5% consists of less-liquid cryptocurrencies that the exchange is acquiring through market purchases and over-the-counter transactions, separately from attempts to trace and recover the stolen assets. Binance is using its corporate treasury, the Secure Asset Fund for Users, or SAFU, and part of its futures insurance fund to cover the losses.
The exchange confirmed that 7,499 BTC was transferred from its publicly disclosed emergency Bitcoin wallet on Saturday as part of the partial deployment of SAFU. By Monday, the wallet held about 7,500 BTC worth $583 million, down from roughly 15,000 BTC before the transfer.
Binance’s SAFU policy provides for monitoring and rebalancing based on the fund’s market value. “If the fund’s market value falls below US $800 million due to BTC price fluctuations, Binance will rebalance the fund to restore its value to $1 billion,” the policy states. The policy does not set a timeline for replenishing assets withdrawn from the fund following a security incident.
Proof of reserves covers 10 cryptocurrencies
Binance announced on Nov. 2 that it had completed the zero-knowledge proof for its Oct. 31 reserve snapshot. The verification covers BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, allowing users to independently check that balances included in the snapshot were backed by reserves of at least 1:1.
The proof applies to balances recorded at 00:00 UTC on Oct. 31. Users can obtain account-specific verification information and download a verification tool through Binance’s official proof-of-reserves platform. The verification does not reveal individual account holdings, but it represents a snapshot rather than Binance’s current financial position and is not an independent audit of the exchange’s overall solvency.
“We've completed the latest Proof of Reserves verification, giving users another way to independently check that their assets are backed,” Binance Co-CEO Richard Teng wrote on X. “There's still work to do, and we'll continue to communicate our progress openly.”
Binance plans another reserve snapshot on Nov. 4 covering additional cryptocurrencies. Binance co-founder and co-CEO Yi He said:
“Computation is required from the snapshot to the updated full zero-knowledge proof, and the generation time depends on the number of tokens.”
She added:
“It is currently estimated that generating the zero-knowledge proof will take about 40 to 50 hours after the snapshot is completed.”
Binance warns of scams during phased reopening
Binance issued a security advisory on Nov. 2 warning that fraudsters could use withdrawal delays to impersonate exchange representatives and target customers seeking transaction updates, compensation or asset recovery. The exchange said the attempts could arrive through fraudulent emails, direct messages, group chats or even small cryptocurrency transfers containing malicious instructions.
Scammers may offer to accelerate pending withdrawals, sell priority access to withdrawal queues, direct customers to purported secure wallets or “Binance vaults,” or send fake compensation eligibility and proof-of-reserves links. Binance said it does not charge customers to unlock withdrawals, provide paid recovery services or require wallet transaction approvals to regain access to funds.
“Anyone promising to expedite it for a fee is scamming you,” Binance said.
Malicious wallet permissions can allow attackers to move assets without further authorization after a customer approves them. Binance told customers with pending withdrawals to check their status directly through its application and use its official verification service when checking suspicious communications.
This article has been refined and enhanced by ChatGPT.
