Binance says 80% of $6.3 billion hack loss already covered, targets phased withdrawal restart Nov. 1

Binance said it has already covered about 80% of the roughly $6.3 billion stolen in its hot wallet breach with the same tokens that were taken, and aims to start reopening withdrawals in phases within about 34 hours. In "Security Incident Update #2," posted at 4:33 a.m. Korea Standard Time (KST) on Oct. 31, co-CEOs Yi He and Richard Teng said the exchange has set aside more than $6.34 billion in company funds. Binance also said it will release proof-of-reserves (PoR) results by Monday, Nov. 2, to show that user assets are in place once the losses have been covered.

Withdrawals to return in phases after about 34 hours

Binance said the withdrawal target is "subject to the completion of security checks." Rather than reopening everything at once, it will take a phased approach and post updates on official channels as each phase becomes available. Deposits and other unaffected services remain operational. The timeline from the announcement is as follows (KST).

In a video posted on X at 11:33 p.m. KST on Oct. 30, Teng said Binance is rebuilding its withdrawal service and is "not switching it back on until it passes rigorous testing." In that video, he put the withdrawal deadline at Sunday, within 40 hours.

80% already held in the same tokens

Binance reaffirmed that it will cover all stolen funds through its Secure Asset Fund for Users (SAFU) and corporate treasury. Of the more than $6.34 billion set aside, $5 billion is held in the same tokens that were stolen, such as USDC, USDT, bitcoin, ether and BNB. Binance said "we have already covered approximately 80% of the impacted amount" and is buying the remaining 20% through market and over-the-counter (OTC) channels. The proof of reserves is intended to let users verify balances once those purchases are complete.

"We NEVER use any customer funds, so they are not impacted."

Richard Teng, co-CEO of Binance

Teng said the breach hit Binance's own hot wallet, and that most user assets sit in cold wallets (storage kept offline) and are only moved into a hot wallet when a user makes a withdrawal. CoinDesk, however, reported that its review of Binance's reserve data found the compromised wallets had previously been listed among assets backing customer balances. About $3 billion has been frozen on-chain to date.

It was not just one laptop

On the morning of Oct. 30, Binance's initial findings pointed to a compromised laptop belonging to a DevOps engineer. In the latest notice, it said its "subsequent investigation has uncovered additional points of breach," adding that it has found no evidence so far that wallet private keys were leaked. In his video, Teng said "this was not carried out by one person," and that the attacker used a self-destruct mechanism that destroyed tooling and traces, making the attack harder to trace.

The attacker used Ethereum's EIP-7702 feature to obtain on-chain execution approval over a hot wallet, and that delegation did not pass through Binance's normal approval controls. That is why Binance paused withdrawals to rebuild and retest its entire infrastructure. The company is reviewing endpoints, cloud, key management and signing, and said it will publish a detailed technical report on what happened and the additional safeguards being put in place. The FBI also said it is aware of the incident and is working with public and private partners to assess its scope, Decrypt reported.

Bitcoin at 104.33 million won on Upbit, kimchi premium 0.96%

As of 10:30 a.m. KST on Oct. 31, bitcoin traded at $77,434 on Binance. It had dropped to $76,326 in the 3 a.m. hour before climbing back by about $1,000. At the same time, BNB was at $706 and ether at $2,244. The funding rate on bitcoin perpetual futures was 0.01%, a normal level.

On Upbit, bitcoin traded at 104,332,000 won and ether at 3,025,000 won. The kimchi premium (the gap between prices on Korean exchanges and global markets) for bitcoin between Upbit and Binance was about 0.96%. BNB is not listed on Upbit's Korean won market and traded at 953,500 won on Bithumb. As of 10:30 a.m. KST on Oct. 31, Upbit had not lifted the withdrawal caution notice for Binance it posted on the morning of Oct. 30.