Binance Sets Aside $6.34B, Phased Withdrawals Planned

Binance earmarks $6.34 billion after major hot-wallet breach

Binance has announced it has reserved more than $6.34 billion to cover assets lost in a large-scale hot-wallet compromise and laid out a timetable to progressively restore withdrawals once security validations are complete. The exchange says roughly $5 billion of the reserved funds are already held in the exact cryptocurrencies that were taken during the attack, including USDC, USDT, Bitcoin (BTC), Ethereum (ETH) and BNB.

Timeline and immediate response

According to the update signed by co-CEOs Yi He and Richard Teng, Binance traced the hot-wallet breach to around 20:05 UTC on Oct. 29. Since discovering the incident, the company has been conducting an internal investigation, isolating compromised infrastructure, revoking affected authorizations, and assembling replacement assets through both market purchases and over-the-counter (OTC) transactions.

Binance emphasized that deposits and most other platform services remain operational while withdrawals are temporarily suspended. The exchange said it will absorb the financial loss through its Secure Asset Fund for Users (SAFU) and corporate treasury rather than passing the cost to users.

Matching token holdings and recovery purchases

Binance reports that approximately $5 billion — about 80% of the estimated $6.3 billion loss — already exists in the same token denominations that were stolen. The firm is actively purchasing the remaining assets to achieve full token-for-token replacement where possible. That process involves live market buys and OTC deals to limit market disruption.

On-chain monitoring tools have flagged some inbound deposits tied to Binance’s repurchase program. One tracker, Lookonchain, reported that Ethena deposited 128.63 million ENA (around $24 million) to Binance across several transfers in an eight-hour window. That post included transaction details alongside Binance’s stated buyback activity but did not confirm whether an OTC agreement was in place.

What users should expect: phased withdrawals and Proof of Reserves

Binance’s engineering team has set an initial target to begin reopening withdrawals within roughly 34 hours from the update, contingent on completing thorough security checks. The company cautions that not every withdrawal type will return simultaneously; services will be brought back in stages, with progress updates published as each phase clears internal validation.

To increase transparency and rebuild confidence, Binance also announced plans for a Proof of Reserves (PoR) process. The exchange intends to take an asset snapshot within 12 hours of the update and publish verified PoR results by Monday, Nov. 2. The PoR report will show platform asset holdings compared to user balances and document the status of funds frozen on-chain and subject to recovery efforts.

Frozen funds, law enforcement cooperation and investigations

The company says approximately $3 billion remains frozen on-chain and is the subject of ongoing recovery operations involving law enforcement, blockchain analytics firms, token issuers and industry partners. Binance describes these funds as frozen and under active recovery — it has not implied the entire frozen sum has already been returned.

Investigators have expanded their scope beyond an initially suspected compromised laptop and identified additional breach vectors. So far, Binance reports no evidence that private keys for wallets were leaked. Earlier technical analysis from third parties pointed to exploitation of Ethereum authorization mechanisms, such as EIP-7702, but Binance expects to share fuller technical findings when safe and verified, within roughly 48 hours.

Market and political reactions

The incident has prompted scrutiny from regulators and political figures. Media-circulated remarks attributed to former President Donald Trump indicated his administration was monitoring the situation. Separately, Senator Cynthia Lummis referenced the CLARITY Act in public comments, arguing the legislation would provide crypto firms clearer legal authority to freeze suspicious transactions promptly after law enforcement contact.

Implications for crypto exchanges and market liquidity

The breach highlights persistent operational risks tied to hot wallets and centralized custody. Exchanges may respond by accelerating multi-signature adoption, increasing on-chain transparency with routine PoR disclosures, and expanding insurance or mutualized safety funds. For markets, Binance’s repurchase program and OTC buys could generate temporary price pressure on specific tokens, while the phased withdrawal plan aims to limit sudden liquidity shocks.

Practical guidance for users

• Monitor official Binance channels for staged withdrawal re-openings and Proof of Reserves publications. These will include asset snapshots and verification details.
• Avoid panic trading; token replacement purchases and OTC activity could cause short-term volatility in affected assets like USDT, USDC, ETH, BTC and BNB.
• Review personal security measures: enable hardware keys or multi-factor authentication, and consider moving long-term holdings to cold storage controlled by private keys you hold.
• If you have large exposures on the platform, consider contacting Binance support for account-specific guidance.

Looking ahead: transparency and resilience

Binance has pledged to cover the financial shortfall via SAFU and its treasury, and is working to restore asset parity using a mix of on-market purchases and OTC agreements. The planned PoR snapshot and subsequent report will be a critical moment for the exchange to demonstrate reserve sufficiency and detail the progress of frozen-asset recoveries.

The ongoing investigation should reveal technical details about the attack vector and enable the broader crypto industry to harden defenses against similar hot-wallet compromises. For traders, developers and institutional participants, the episode underscores the importance of custody diversification, on-chain monitoring, and cooperative law enforcement relationships to improve asset recovery outcomes.

Binance’s second recovery update, published Oct. 30 and signed by Yi He and Richard Teng, provides the framework for phased restorations and the PoR timeline. As the exchange moves to re-enable withdrawals in stages and publishes verified reserve data, market participants and regulators will be watching for transparency, technical findings, and final outcomes of ongoing asset-recovery efforts.