Binance restarted customer withdrawals on Sunday, four days after hackers drained approximately $6.3 billion from its hot wallets in what the exchange described as the largest crypto theft on record. The reopening took place in stages, beginning with bitcoin before expanding to 15 networks.
The exchange said on Saturday that it had replenished 90% of the affected amount using company funds, part of its Secure Asset Fund for Users, a portion of its futures insurance fund and its corporate treasury. Binance also released a proof-of-reserves snapshot dated October 31 to give customers a reference for checking their balances.
Withdrawals began at 06:00 UTC with BTC and later expanded to ETH, BNB Smart Chain, Solana, XRP, Dogecoin, Tron, Polygon, Avalanche, Arbitrum, Base, Optimism, Zcash, TON and Sui. From 06:00 to 15:30 UTC, Binance processed around $4.65 billion in withdrawals and approximately $1.01 billion in deposits, resulting in a net outflow of about $3.64 billion.
That outflow represented roughly 2.1% of the $171 billion in assets reported in Binance’s late-October proof of reserves. Deposits remained available during the rollout, although the exchange warned that users could experience temporary delays because of the initial increase in activity.
Binance said its Sunday update raised coverage of the affected amount to 95%. The remaining 5% consists of less liquid tokens outside the top ten assets listed in its reserves report. The exchange is working with industry partners and over-the-counter trading desks to acquire those tokens and has said customers will not absorb the financial loss.
On Monday, Binance announced that the full zero-knowledge proof for its October 31 snapshot was complete. Customers holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can use the exchange’s open-source verifier to confirm that their balances are backed at least 1:1.
Binance plans to publish another snapshot covering additional tokens on November 4. The exchange expects generating the corresponding proof to take between 40 and 50 hours. A further withdrawal phase is planned for Tuesday, with details to be released once the rollout is ready.
The FBI has attributed the attack to North Korea, while the U.S. Secret Service is working with Circle to trace and freeze the stolen funds. Tether said it had frozen approximately $1.57 billion in USDT, and Circle reported freezing more than $800 million in USDC in coordination with authorities.
The breach also triggered a sharp market reaction. Bitcoin fell about 5% to below $77,000 after the attack, while shares of Coinbase, Robinhood, Strategy and Strive declined as investors assessed the broader risks of exchange-level losses.
Binance has said investigators identified additional breach points beyond the initial compromise, which the exchange had first linked to a single engineer’s laptop. A complete post-mortem explaining how the attackers prepared and carried out the operation has not yet been published. The destination of approximately $3.3 billion in unfrozen stolen funds also remains unclear, while investigators continue tracking wallet activity across ten blockchains.
Sources: Bitcoin Magazine.