Binance officially restarted customer withdrawals on Sunday, marking the end of a tense four-day freeze that followed the largest cryptocurrency theft in history. The operational restart came after hackers drained roughly $6.3 billion from the platform’s hot wallets, triggering immediate industry-wide shockwaves and a comprehensive emergency response from the world’s largest digital asset exchange.
The exchange reopened its withdrawal gates in a carefully managed, staged rollout over the weekend, beginning with Bitcoin before rapidly expanding to encompass 15 different blockchain networks. This measured approach served as the first true operational test of whether the massive platform could absorb an unprecedented financial loss of this magnitude without locking its global customer base out of their funds for an extended period.
The intensive recovery push officially began on Saturday as leadership scrambled to patch vulnerabilities and secure replacement assets. In its third official recovery update issued over the weekend, Binance reported that it had successfully replenished 90% of the heavily impacted funds using a combination of internal corporate resources. To bridge the massive deficit, the exchange drew from its Secure Asset Fund for Users, a targeted portion of its futures insurance fund, and its overarching corporate treasury to purchase replacement tokens on the open market.
The decision to utilize capital from the futures fund immediately drew intense scrutiny from market observers and analysts, largely because Binance had previously characterized the remaining balance of that specific fund as a strict regulatory requirement. Alongside these emergency financial maneuvers, Binance published an updated proof-of-reserves snapshot dated October 31, providing its millions of users with an essential baseline to independently check their individual account balances against verified assets.
The staged reopening commenced precisely at 06:00 UTC on Sunday morning, starting with Bitcoin. As operations stabilized, Binance progressively integrated additional major assets and networks, including Ether, BNB Smart Chain, Solana, XRP, Dogecoin, Tron, Polygon, Avalanche, Arbitrum, Base, Optimism, Zcash, TON, and Sui.
During the initial heavy surge of activity between 06:00 and 15:30 UTC, the exchange successfully processed approximately $4.65 billion in customer withdrawals against roughly $1.01 billion in incoming deposits. That frantic period of activity produced a net outflow of approximately $3.64 billion, which represented roughly 2.1% of the total $171 billion in assets that Binance had reported in its late-October proof-of-reserves audit.
Throughout the entire rollout, customer deposits remained fully open, though platform representatives warned that temporary processing delays could occur due to the extraordinary spike in network volume and user demand.
By Sunday evening, an additional update from Binance indicated that total asset coverage had successfully climbed to 95% of the total amount impacted by the exploit. The remaining 5% of the lost funds currently sits in less liquid tokens residing outside the top ten assets listed on the exchange’s proof-of-reserves inventory. Sourcing those specific digital assets at the massive scale required naturally demands significantly more time, and exchange executives noted they are actively collaborating with key industry partners and over-the-counter trading desks to quietly complete the necessary purchases. Binance has repeatedly emphasized its absolute commitment to covering the full financial shortfall, assuring jittery market participants that ordinary users will not bear any of the financial burden resulting from the breach.
Moving into the new week, Binance confirmed that the full zero-knowledge proof for the critical October 31 snapshot is completely finalized. Users holding major assets including Bitcoin, Ether, Tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD, or Zcash can now utilize the exchange’s open-source verifier tool to independently confirm that their individual balances are backed at least on a strict 1-to-1 ratio. The exchange has directed its user base to detailed operational guidance regarding how to run the verification process.
Looking ahead, Binance plans to publish another comprehensive snapshot covering an even broader array of tokens on November 4, with the resulting cryptographic proof expected to take between 40 and 50 hours to fully generate. A subsequent phase of the withdrawal expansion is formally scheduled for Tuesday, with exchange leadership promising to release further logistical details as soon as the rollout infrastructure is fully prepared.
Binance Hack Background
On the broader legal and law enforcement fronts, the investigation into the perpetrators has escalated rapidly. The Federal Bureau of Investigation has formally attributed the devastating cyberattack to state-sponsored actors linked to North Korea, while the U.S. Secret Service has stepped in to actively collaborate with private firms like Circle to trace, intercept, and freeze stolen funds wherever possible. Collaborative efforts have yielded tangible results, with Tether publicly reporting that approximately $1.57 billion in USDT had been successfully frozen, while Circle confirmed that it had frozen more than $800 million in USDC in direct coordination with international regulatory and law enforcement authorities.
The wider cryptocurrency market reacted with swift volatility to the breaking news of the security breach. Bitcoin’s market price dropped by roughly 5% in the immediate hours following the attack, sinking below the $77,000 threshold. Traditional equities tied to the digital asset ecosystem, including shares of Coinbase, Robinhood, Strategy, and Strive, also experienced notable downward pressure as institutional and retail investors weighed the systemic risk of exchange-level security failures spreading across the wider financial sector.
Compounding the initial shock, Binance disclosed that its internal security teams uncovered additional points of compromise beyond the initial entry vector. The company originally attributed the sprawling exploit to a single engineer’s compromised laptop, but subsequent findings revealed that the attackers utilized multiple auxiliary entry points. Notably, the exchange has not yet published an exhaustive post-mortem analysis detailing precisely how the malicious actors meticulously prepared and executed the operation—an attack that external blockchain security estimates suggest required at least 36 hours of sophisticated preliminary groundwork.
Furthermore, the final destination of approximately $3.3 billion in stolen funds that have thus far eluded freezing mechanisms remains largely unexplained. The exchange has yet to provide granular details regarding what portion of that massive pool it realistically expects to recover. In the meantime, blockchain forensic investigators and platform security teams continue to track suspicious wallet activity scattered across ten distinct blockchain networks.
