Binance has set aside more than $6.34 billion to cover its $6.3 billion security breach and outlined plans to begin restoring withdrawals within approximately 34 hours, subject to security checks.
Summary
- Binance says $5 billion is already held in the same cryptocurrencies stolen during the attack.
- Withdrawals will reopen in phases after security checks, while deposits and unaffected services remain operational.
- Proof of Reserves results are scheduled for Nov. 2, following an initial asset snapshot.
- Investigators have identified additional breach points, with no evidence so far of leaked wallet private keys.
Binance’s second recovery update, dated Oct. 30 and signed by co-CEOs Yi He and Richard Teng, says the exchange will absorb the losses through its Secure Asset Fund for Users and corporate treasury.
The company placed the start of the hot-wallet compromise at approximately 20:05 UTC on Oct. 29. Since then, its teams have been investigating the attack, securing affected infrastructure and arranging replacement assets while withdrawals remain suspended.
“Binance will absorb the financial impact of these stolen funds, not our users,” the announcement states.
Binance has secured 80% of the matching tokens
Within the funds reserved for compensation, Binance says it already holds $5 billion in the exact affected cryptocurrencies, including USDC, USDT, Bitcoin, Ethereum, and BNB.
Its estimate that approximately 80% has been covered refers to those matching token holdings. The company has committed more than the estimated dollar loss, but it is still purchasing the remaining cryptocurrencies through market transactions and over-the-counter deals.
Using Binance’s rounded figures, $5 billion represents roughly 79.4% of the $6.3 billion loss, leaving approximately $1.3 billion in matching assets to acquire.
As crypto.news previously reported, Yi He described the asset replacement purchases as an effort to restore stolen altcoins in fully matching quantities. She identified BTC and ETH among Binance’s existing holdings, without disclosing how much of either asset would be sold.
On-chain tracker Lookonchain subsequently reported that Ethena deposited 128.63 million ENA, valued at approximately $24 million, into Binance over eight hours.
Lookonchain presented the transfers alongside Binance’s repurchase program. Its post did not identify a confirmed OTC agreement or disclose the purpose of Ethena’s deposits.
Withdrawals will return in phases after security checks
Under the timetable in the announcement, Binance’s technical team targets the start of withdrawal restoration within approximately 34 hours. Completion of security checks remains a condition, and the company has not promised that every withdrawal service will return simultaneously.
The reopening will proceed in stages, with updates issued as each phase becomes available. Deposits and other unaffected platform services remain operational during the suspension.
Security work completed so far includes containing compromised infrastructure, revoking affected authorizations, and introducing controls intended to prevent further unauthorized activity.
The exchange says it is validating the integrity of affected systems before reopening withdrawals. Teng’s accompanying post repeated that withdrawals would resume once security checks were complete.
Proof of Reserves results are planned for Monday
Alongside the withdrawal preparations, Binance plans an initial Proof of Reserves snapshot within 12 hours of its update, with results ready by Monday, Nov. 2.
According to the announcement, the reports will show updated platform asset holdings and the corresponding backing of user balances. The planned snapshot and publication are separate steps, with Monday identified as the date for results.
Recovery efforts remain underway for approximately $3 billion frozen on-chain through cooperation with law enforcement, blockchain intelligence firms, token issuers, and industry partners.
Binance describes the assets as frozen and says it is working to recover them. The announcement does not state that the entire frozen amount has already been returned.
Its investigation has progressed beyond an initially suspected compromised laptop, uncovering additional points of breach. No evidence of leaked wallet private keys has been found at this stage.
Earlier wallet attack findings attributed to Blockaid described the use of Ethereum’s EIP-7702 authorization mechanism against Binance 14. Binance expects further technical findings within roughly 48 hours, once verified and safe to disclose.
Trump and Lummis respond to the Binance breach
In remarks circulated by Bitcoin Magazine, President Donald Trump said his administration was looking into the incident.
“We’re looking at that…They say they have it pretty much under control. We’ll see.”
Coin Bureau separately quoted Trump saying “we don’t know” when asked whether North Korea was responsible.
Sen. Cynthia Lummis argued in a post that the CLARITY Act would have given crypto firms legal cover to freeze suspicious transactions immediately after contact from law enforcement.
Her office’s Sept. 15 statement confirms that a Senate motion to proceed with the legislation failed.
