NextFin News - Binance will reopen customer withdrawals in phases starting Sunday afternoon, three days after attackers drained an estimated $6.3 billion from its hot wallets in the largest cryptocurrency theft on record. The resumption is a test not of whether the exchange was breached - it was, across roughly ten blockchains in about 20 minutes - but of whether the world's biggest crypto platform can make users whole without triggering a run on its reserves.
The company said phase one of withdrawals would begin from 2 p.m. to 5 p.m. Singapore time on Sunday, Nov. 1, after it halted transactions on Friday morning in Asia. By Saturday, Binance said it had covered up to 90 percent of the stolen assets and that its ten most-traded tokens - Bitcoin, Ether, Tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD and ZEC - were fully backed at 100 percent. The remaining 10 percent consists of less-liquid tokens outside the top ten, which the exchange said it would continue sourcing through market and over-the-counter channels until coverage reached 100 percent for every token.
The question now is not whether Binance can pay - it has reserved more than $6.34 billion and has about $3 billion of the stolen assets frozen on chain through stablecoin issuers and industry partners. The question is what the breach reveals about the fragility of centralized custody at scale, and whether a phased reopening can restore trust faster than the hack destroyed it.
The Breach: A $6.3 Billion Theft Executed in Minutes
The attack began around 20:05 UTC on Oct. 29, 2026, when unauthorized withdrawals were pushed through Binance's own signing infrastructure as if they were legitimate. Independent estimates place the total loss between $6.34 billion and $6.4 billion, roughly four times the $1.5 billion taken from Bybit in February 2025 and larger than any previous crypto heist. The funds left hot wallets across about ten blockchains - including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon - mostly within a 20-minute window.
Binance's initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which gave an attacker access to a service container used to submit withdrawal transactions. Co-CEO Richard Teng later said the attack involved a more complex process than the misuse of a single engineer's permissions, and the exchange said it found no evidence that wallet private keys were leaked. It revoked authorization for the affected address and engaged law enforcement and blockchain-intelligence partners.
Blockchain-intelligence firm TRM Labs attributed the theft to North Korea-linked hackers, citing patterns that matched earlier heists including the Bybit attack and the KelpDAO exploit in April 2026: small withdrawals through the privacy mixer Tornado Cash funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in a single burst. Neither Binance nor any government has confirmed the attribution.
"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst," TRM Labs said.
The speed of the drain matters. Bybit's $1.46 billion theft in February 2025 exploited the user interface of a Safe multisig cold wallet through a phishing attack and split the funds across 39 addresses; Binance resumed normal withdrawals in less than 12 hours. Binance's incident was larger, faster, and spread across many more chains - and its response has been correspondingly more deliberate, with deposits operating normally throughout while withdrawals remained paused.
The Recovery: Why $3 Billion Frozen Is Not the Same as $3 Billion Recovered
About $3 billion of the stolen assets has been frozen on chain, close to half of the estimated loss. The freezes came mostly from stablecoin issuers and chain operators, because centralized issuers can immobilize tokens held at specific addresses within minutes of a theft. Tether said it froze nearly $1.57 billion in assets linked to the incident, Circle froze more than $800 million, Ripple froze roughly $200 million, and World Liberty Financial said it froze $27 million in stablecoins plus about $2 million of its own tokens. The first large freezes landed within about 40 minutes of the main Ethereum sweep.
But a freeze is not a recovery. Frozen assets remain in attacker-controlled wallets; they are immobilized, not returned. Binance cannot simply hand those tokens back to users. Instead, the exchange is replenishing customer balances out of its own reserves while the frozen funds remain locked in a legal and technical limbo that could take months or years to resolve through law-enforcement channels.
That is why the funding stack matters. Binance said it is tapping its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury. As of 2026, the SAFU fund holds crypto assets worth roughly $1 billion, entirely in bitcoin, according to the company's own website. That is not enough to cover a $6.3 billion loss on its own, which is why the exchange's ability to draw on its corporate treasury - and to source tokens in liquid markets without moving prices against itself - is the real backstop.
On Oct. 30, Teng said the exchange had reserved more than $6.34 billion and already held $5 billion in the exact impacted assets, with about $3 billion frozen through partners. By Saturday, the company said coverage had reached 90 percent of stolen assets, with the top-ten tokens fully backed. The outstanding 10 percent, it said, consists of tokens outside the top ten that are less liquid and may take longer to source in the required amounts.
"All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%," Binance said in a statement. "Binance will absorb the financial impact of these stolen funds, not our users."
There is one visible gap. The stolen wallets were included in Binance's October reserve disclosures, and analysis of that snapshot suggests the breach could leave the exchange's ether backing approximately 6 percent below customer holdings unless the missing assets have already been replenished. The next proof-of-reserves snapshot, expected on Nov. 1, is the first independent check on whether the replenishment is complete.
The Market Reaction: A Sell-Off That Stopped Short of Panic
Markets reacted immediately in early Asian trading on Friday. Bitcoin dropped more than 3 percent to a six-week low of $76,368, and ether fell more than 3 percent to a two-month low of $2,178. By 19:41 ET on Oct. 30, Bitcoin had pared some losses to $78,505.9, down 3.5 percent, and was on track to lose 6.1 percent for the month, snapping a historical run of seasonal strength. BNB took a bigger hit than Bitcoin, dropping 5.6 percent in 24 hours to around $679 as of early New York time on Oct. 30 - the steepest decline among the major tokens.
The broader crypto market fell around 3.6 percent to approximately $2.68 trillion in market capitalization. CoinGlass data showed more than $1.6 billion in leveraged crypto positions were liquidated in the same 24-hour window, with long positions accounting for $1.35 billion of the wipeout. The liquidation cascade, rather than the theft itself, did much of the early price damage - a reminder that in crypto, a security incident at one venue becomes a systemic leverage event within minutes.
The spillover reached listed equities tied to digital assets. Shares of Coinbase Global slid 4.8 percent, while those of MicroStrategy, the bitcoin-buying software company, fell nearly 6 percent in extended U.S. trading. Yet the selloff stayed contained: Bitcoin did not break its recent range, and the market absorbed a loss larger than the entire Bybit heist without broader contagion. That relative calm reflects two things - the market's growing familiarity with exchange hacks, and the credibility of Binance's commitment to cover every dollar.
"It's the biggest hack in history," said Aravind Srinivasan, head of large crypto market maker GSR's systematic OTC business.
"It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges, as well as counterparty, solvency and liquidity risks," said Tim Sun, a senior researcher at HashKey Group in Hong Kong.
Why This Time Is Different: Custody at Scale Meets a State-Sponsored Adversary
The Binance hack is not just a bigger version of earlier exchange thefts. It is a different kind of event, and the distinction determines whether the industry learns from it or merely absorbs it.
Earlier large exchange failures - Mt. Gox reporting about 850,000 bitcoin missing when it filed for bankruptcy, or the DAO losing about 3.6 million ether to a code flaw in 2016 - were failures of solvency or code. Binance's incident is a failure of operational security at a scale no exchange has previously operated: 335 million registered users and about $162.8 billion in assets under custody as of its 2025 annual report, all exposed through a single withdrawal-signing path.
The mechanism is the story. The attacker did not break a blockchain, steal a private key, or exploit a smart-contract bug. According to Binance's own account, it gained access to a service container and made Binance's systems sign and send funds as authorized transactions. Every withdrawal was validly signed. The record shows what moved; it does not show who asked Binance's system to sign, or how. That distinction matters because the fix is not a software patch - it is a redesign of how a centralized exchange authorizes its own withdrawals.
Teng said the exchange is rebuilding its withdrawal infrastructure "from the ground up" while auditing security across the entire company, and that withdrawals would not resume until the new system passed rigorous testing. That is a structural response to a structural weakness: when the signing path itself is the vulnerability, the only durable fix is to make the path itself harder to compromise.
Is this cyclical or structural? The price impact is cyclical - crypto markets have absorbed exchange hacks before, leverage gets flushed, and sentiment mean-reverts once the venue proves it can pay. But the lesson is structural. The attack demonstrates that even the largest, most-resourced exchange can be emptied through its own authorization chain, and that stablecoin issuers - not the exchange - are now the first line of defense, able to freeze roughly half the loot within an hour. That shifts the security perimeter outward: custody risk is increasingly a function of what issuers and chains can freeze, not just what the exchange can defend.
"My view is that users will move away from smaller and medium-sized exchanges, (it is) becoming too risky to park your money somewhere that couldn't cover a hack of meaningful size," said Bernardo Brites, CEO of Trace Finance, a payments and stablecoin infrastructure company.
The Counter-Thesis: Containment Is Not Solvency, and Trust Is Not a Balance Sheet
The strongest case against alarm is straightforward: Binance has the reserves, the frozen assets buy time, and the phased reopening proves the breach was operational rather than existential. If the exchange covers 100 percent of losses - as it has committed to do - then for users the incident ends as an inconvenience, not a loss. By that reading, the market's measured reaction is rational, and the episode will be remembered as a stress test that centralized custody passed.
That argument is powerful but incomplete. It assumes that covering losses is the same as restoring trust, and that a balance sheet can substitute for an unbroken security record. History suggests otherwise. Mt. Gox covered nothing and collapsed; but FTX, which also had a balance sheet that appeared sufficient until it did not, collapsed anyway because trust left before the accounts were proven wrong. Binance's proof-of-reserves snapshot on Nov. 1 will tell investors whether the ether backing is complete; a shortfall larger than the estimated 6 percent, or evidence that replenishment required selling assets at a loss, would test the market's confidence in ways a statement cannot.
The second-order risk is not that Binance fails - it is that the incident raises the cost of custody for the entire industry. If investors reassess counterparty risk at centralized exchanges, capital migrates toward self-custody, toward venues with clearer insurance structures, or out of crypto altogether. That migration is slow, invisible in daily price action, and far more damaging to the centralized-exchange business model than any single-day selloff. The signal to watch is not Bitcoin's price; it is exchange reserve balances and stablecoin supply on centralized venues over the coming weeks.
What Comes Next: Three Scenarios for the Phased Reopening
Base case. Phase one opens on schedule Sunday afternoon Singapore time, technical checks hold, and subsequent phases restore full withdrawal functionality within days. Proof-of-reserves on Nov. 1 shows the top tokens fully backed, the 6 percent ether gap is closed, and the market treats the incident as contained. Bitcoin trades sideways to slightly higher as the liquidation overhang clears.
Downside case. The phased reopening encounters technical problems, or the Nov. 1 reserve snapshot reveals a larger shortfall than the estimated 6 percent, or Binance is forced to sell assets into thin markets to complete coverage. In that scenario, confidence erodes, withdrawals queue, and the initial $1.6 billion liquidation event looks like the first wave rather than the whole storm. The falsifying signal for the contained-incident thesis: if net outflows from Binance exceed $5 billion within a week of reopening, or if the proof-of-reserves snapshot shows any top-ten token below 100 percent backing, the market will treat this as a solvency question, not an operational one.
Upside case. The reopening is smooth, the reserve snapshot is clean, and the episode becomes a case study in how a well-capitalized exchange should handle a breach - faster and more transparently than any predecessor. That outcome would strengthen Binance's competitive position relative to smaller venues that could not absorb a comparable loss, and could accelerate consolidation around the best-capitalized platforms.
In the short term, liquidity and sentiment dominate: the phased schedule is designed to prevent a run, and it will succeed if the queue stays manageable. In the medium term, fundamentals matter: whether Binance's reserves are genuinely intact, and whether the rebuild of its withdrawal infrastructure holds. In the long term, the structural question is whether centralized exchanges can ever make their signing paths secure enough to justify the custody they hold - or whether the perimeter has permanently shifted to issuers, chains, and self-custody.
The phased reopening is a race between two clocks: how fast Binance can restore function, and how fast users can decide they no longer need it to. The market has priced the first; the second is the one that will define the next cycle.
Explore more exclusive insights at nextfin.ai.
