Binance Co-CEO Yi He Rejects FTX Parallels After $6.3B Hack

Binance leadership pushes back on FTX comparisons

Binance co-founder and co-CEO Yi He has firmly rejected comparisons between the exchange and the collapsed rival FTX as the company continues to respond to the October 29 attack that drained roughly $6.3 billion from hot wallets. In a public post on X on November 2, Yi He said the exchange's immediate priority is to secure its systems before allowing customers to resume withdrawals and for normal operations to restart.

"Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations," Yi He wrote. Her comments came amid intense scrutiny from industry observers and regulators, and they directly addressed concerns that Binance could face the same liquidity and transparency issues that felled FTX in 2022.

Context: why the comparisons surfaced

The FTX collapse in November 2022 followed a sudden wave of customer withdrawals that exposed a multibillion-dollar balance shortfall and ultimately led to criminal prosecutions for former executives. That history has made crypto investors and journalists especially sensitive to any large-scale security incident at a major exchange. Critics pointed to the size of the Binance hack and asked whether customers would again face locked balances or undisclosed losses.

Yi He pushed back on those parallels by stressing Binance’s liquidity position and its use of company resources to make customers whole. A post cited by Yi He suggested Binance holds approximately $171 billion in assets, and the company itself has reported replacing roughly 95% of the tokens drained in the October 29 breach.

Yi He’s wider critique of opaque institutions

Beyond the immediate technical and security response, Yi He criticized a broader pattern she says is common among fraudulent exchanges and opaque financial institutions: sudden shutdowns that leave customers unable to determine what happened to their deposits. In her remarks she warned that some businesses can disappear without explanation, leaving investors without access to funds or a clear accounting of their balances.

"Every action has a motive," she wrote, describing scenarios where companies abruptly cease operations, enter liquidation or declare bankruptcy while clients remain unable to withdraw funds. Although she did not name FTX directly in that post, the implication was clear: transparency and provable reserves are essential to prevent customer harm.

Binance’s stance on customer protection

Binance has repeatedly emphasized that customers will not bear losses from the attack. The exchange says it has deployed internal treasury resources, tapped the Secure Asset Fund for Users (SAFU), and used futures insurance funds to replace stolen assets while it works through a phased reopening of withdrawal services. According to Binance’s updates, about 95% of the $6.3 billion has been replenished; the remaining 5% involves less liquid tokens that are more difficult to procure on short notice.

Which withdrawal services have resumed and how Binance is phasing access

Binance began a phased restoration of withdrawals on November 1, nearly three days after suspending services following the breach. Bitcoin withdrawals were the first major asset to reopen. The initial recovery window ran between 06:00 and 09:00 UTC and covered selected cryptocurrencies across 15 networks.

In the first phase, Binance reopened withdrawals for major assets including BTC, ETH, BNB and several stablecoins such as USDT and USDC on Ethereum and BNB Smart Chain. Other supported networks named in the phased plan included Tron, Solana, XRP Ledger, Polygon, Avalanche, Arbitrum, Base, Optimism and Sui.

Operational safeguards during the reopening

Deposits remained operational throughout the withdrawal suspension, and unaffected platform services continued running. Binance warned customers of potential temporary processing delays as security teams monitored network activity and validated each asset and chain before enabling withdrawals. Individual assets and networks were to be restored only after completion of security checks, with priority given to cryptocurrencies that had seen higher customer demand in the week before the breach.

Binance has not set a single target date to restore every affected withdrawal route and said it will continue to expand services based on the outcomes of ongoing security reviews.

How Binance replaced most of the stolen assets

In a recovery briefing, Binance disclosed that roughly 95% of the $6.3 billion stolen was replaced using company resources. The firm reported that balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP and a number of other tokens were fully backed again. To rebuild those holdings, Binance said it repurchased stolen cryptocurrencies via exchanges and over-the-counter desks using corporate reserves.

Binance also reported previously that around $3 billion of the stolen funds had been frozen on-chain through cooperation with blockchain analytics partners, token issuers and law enforcement. Following the partial reopening, the exchange saw net customer withdrawals of about $3.64 billion, which Binance characterized as approximately 2.1% of its reported assets. The company said withdrawals began stabilizing after an initial surge while deposits remained substantial.

Funds and insurance used for recovery

To fund the replacement program, Binance drew on multiple sources: SAFU, its corporate treasury and the futures insurance fund. The company had earlier stated it allocated more than $6.34 billion to cover the incident, noting that around $5 billion was already held in the corresponding affected tokens by October 30.

Ongoing investigation into the October 29 attack

The attack began at approximately 20:05 UTC on October 29, when threat actors drained assets from Binance hot wallets across multiple chains. Initial investigative leads suggested a compromised employee laptop may have given attackers a route into infrastructure that enabled unauthorized withdrawals. Subsequent probes identified additional points of compromise, although Binance said it had found no evidence that wallet private keys were exfiltrated.

Blockchain investigators, including TRM Labs, traced the stolen funds across about 10 networks and estimated initial outflows at roughly $6.36 billion. In response, Binance revoked affected authorizations, isolated compromised systems, and rolled out additional security controls while coordinating with law enforcement and blockchain partners.

Binance has committed to publishing a detailed technical report on the incident and scheduled an updated proof-of-reserves report to provide transparency on its asset holdings and the reserves that back customer balances. Those disclosures are expected to be closely watched by industry participants, regulators and customers seeking assurance that their funds are protected.

What this means for the crypto industry

The incident has renewed discussion about security best practices for centralized exchanges, the importance of proof-of-reserves, and the role of corporate transparency in maintaining market confidence. Binance’s rapid replacement of the vast majority of stolen assets and its phased reopening approach aim to demonstrate that large exchanges can withstand serious breaches without forcing customers to absorb losses. Still, the event highlights that cyber risk remains a core vulnerability for custodial platforms and an area where stronger controls and transparent reporting will be essential.

For now, Binance customers are advised to monitor official company channels for updates on withdrawal availability and to follow security recommendations such as enabling two-factor authentication, using hardware wallets for long-term holdings, and maintaining careful operational hygiene around accounts.