Binance Sets Aside $6.34B, Eyes Phased Withdrawals in 34 Hours
Binance's second recovery update commits more than $6.34B to cover the $6.3B breach, with $5B already held in matching tokens and $1.3B left to buy. Withdrawals return in phases within about 34 hours; Proof of Reserves results land Nov. 2.
More than $6.34 billion is now earmarked to cover Binance's roughly $6.3 billion hot-wallet breach, and the exchange says withdrawals start coming back in phases within about 34 hours, subject to security checks. The pledge sits in a second recovery update dated Oct. 30 and signed by co-CEOs Yi He and Richard Teng. The 34-hour target revises the timeline in our previous update, which followed our earlier coverage of the breach. Binance dates the compromise to about 20:05 UTC on Oct. 29.
Losses will come from the Secure Asset Fund for Users and the corporate treasury. The update puts it bluntly:
"Binance will absorb the financial impact of these stolen funds, not our users"
Binance announcement, signed by Yi He and Richard Teng
Binance says it already holds $5 billion in the exact tokens affected, including USDC, USDT, Bitcoin, Ethereum and BNB. It calls that about 80% covered; the math works out to roughly 79.4% of the loss. The remaining $1.3 billion in matching assets still has to be bought through market and OTC deals. For traders, that is a buyer with a known shopping list, and the size is worth watching.
Lookonchain reported that Ethena deposited 128.63 million ENA, about $24 million, into Binance over eight hours. Its post did not identify an OTC deal or a purpose for the deposits, so treat any link to Binance's buying as unconfirmed.
Withdrawals, reserves and frozen funds
Withdrawals reopen in phases after security checks. Deposits and unaffected services remain live. Binance has not promised every withdrawal service returns at once.
An initial Proof of Reserves snapshot is planned within 12 hours of the update, with results due Monday, Nov. 2. About $3 billion is frozen on-chain through cooperation with law enforcement, blockchain intelligence firms, token issuers and partners. The announcement does not say the full amount has been recovered.
Investigators found additional breach points beyond the initially suspected compromised laptop. There is no evidence so far of leaked wallet private keys, and further technical findings are expected within roughly 48 hours. Earlier findings attributed to Blockaid described the use of Ethereum's EIP-7702 authorization mechanism against Binance 14.
The Bitcoin trail
The haul includes 18,270 BTC, worth about $1.4 billion at $78,500 per coin. That is more than Tesla's 11,509 BTC and over twice El Salvador's roughly 7,820 BTC, and within 442 BTC of SpaceX's 18,712 BTC.
The BTC left a Binance hot wallet at about 4:20 p.m. ET on Thursday in 11 transactions to a new address. That address split the coins among 19 wallets: 17 hold exactly 1,000 BTC each, and the other two hold about 833 BTC and 438 BTC. None had spent as of 2:02 a.m. ET Friday.
Seventeen clean 1,000 BTC piles sitting still. Nobody has dumped anything yet.
Attribution and politics
TRM Labs attributed the attack "with high confidence" to North Korea's TraderTraitor, the group the FBI blamed for the $1.5 billion Bybit theft in February 2025. Binance has not identified the attacker. Trump said his administration is looking into the incident; asked whether North Korea was responsible, he said "we don't know."
Sen. Cynthia Lummis argued on X that the CLARITY Act would have given firms legal cover to freeze suspicious transactions after contact with law enforcement.
Her office's statement confirms a Senate motion to proceed with the bill failed.
What it means
Paying for a hit this size out of reserves is exactly what SAFU exists for, but 80% in hand is not 100%. The open questions are execution on the $1.3 billion buy, the Nov. 2 Proof of Reserves results, and how much of the $3 billion frozen actually gets clawed back. Those are the numbers that decide whether the phased reopening holds.
