Binance restarted customer withdrawals on Sunday, four days after hackers drained roughly $6.3 billion from its hot wallets in the largest crypto theft on record.
The exchange reopened in stages over the weekend, starting with bitcoin and expanding to 15 networks. The move marked the first real test of whether the platform could absorb a loss of that size without freezing its customers out for longer.
The recovery push began Saturday. In its third recovery update, Binance said it had replenished 90% of the impacted amount with company funds. The exchange drew on part of its Secure Asset Fund for Users, a portion of its futures insurance fund and its corporate treasury to buy replacement tokens.
The futures fund contribution drew particular attention, since Binance described the remaining balance as a regulatory requirement. Binance also published a new proof-of-reserves snapshot dated October 31, giving users a baseline to check their balances against.
Sunday’s reopening began at 06:00 UTC with BTC. Binance then added ETH, BNB Smart Chain, Solana, XRP, Dogecoin, Tron, Polygon, Avalanche, Arbitrum, Base, Optimism, Zcash, TON and Sui. Between 06:00 and 15:30 UTC, the exchange processed about $4.65 billion in withdrawals against roughly $1.01 billion in deposits.
That produced a net outflow near $3.64 billion, equal to about 2.1% of the $171 billion in assets Binance reported in its late-October proof of reserves.
Deposits stayed open throughout the rollout, and the exchange said temporary delays were possible during the initial surge in volume.
Binance said its Sunday update raised coverage to 95% of the impacted amount. The remaining 5% sits in less liquid tokens outside the top ten assets on its proof-of-reserves list. Sourcing those tokens at the required scale takes more time, and the exchange said it is working with industry partners and over-the-counter desks to complete the purchases. Binance has committed to covering the full amount, and it has repeated that users will not bear the financial impact of the theft.
On Monday, Binance said the full zero-knowledge proof for the October 31 snapshot is complete. Users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can run the exchange’s verifier to confirm their balances are backed at least 1:1.
The verifier is open source, and the exchange has pointed users to a step-by-step guide.
The exchange plans another snapshot covering more tokens on November 4, with a proof expected to take 40 to 50 hours to generate. A further withdrawal phase is scheduled for Tuesday, and the exchange said it would share details once the rollout is ready.
Binance hack background
On the law enforcement front, the FBI has attributed the attack to North Korea, and the U.S. Secret Service is working with Circle to trace and freeze funds. Tether reported about $1.57 billion in USDT frozen, and Circle said it had frozen more than $800 million in USDC in coordination with authorities.
The market reacted sharply to the breach. Bitcoin fell about 5% to below $77,000 in the hours after the attack, and shares of Coinbase,Robinhood, Strategy, and Strive all declined as investors weighed the risk of exchange-level losses across the sector.
Binance has said it found additional points of breach beyond the initial compromise, which it originally attributed to a single engineer’s laptop. The exchange has not yet published a full post-mortem explaining how the attackers prepared and executed the operation, which some estimates suggest took at least 36 hours of groundwork.
The destination of roughly $3.3 billion in stolen funds that were not frozen has also not been fully explained, and the exchange has not detailed what it expects to recover from that pool. Investigators continue to track wallet activity across ten blockchains.
