Binance reopened customer withdrawals on Sunday, four days after hackers drained approximately $6.3 billion from its hot wallets. The exchange restarted in stages, beginning with Bitcoin and expanding to 15 networks including ETH, BNB Smart Chain, Solana, XRP, Dogecoin, Tron, Polygon, Avalanche, Arbitrum, Base, Optimism, Zcash, TON and Sui.
Between 06:00 and 15:30 UTC on Sunday, Binance processed about $4.65 billion in withdrawals against roughly $1.01 billion in deposits, producing a net outflow near $3.64 billion, or about 2.1% of the $171 billion in assets the exchange reported in its late-October proof of reserves.
Binance said it had replenished 90% of the impacted amount with company funds drawn from its Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury. By Sunday's update, coverage reached 95% of the impacted amount. The remaining 5% sits in less liquid tokens outside the top ten assets, and the exchange said it is working with industry partners and over-the-counter desks to complete those purchases.
Binance published a full zero-knowledge proof for its October 31 snapshot on Monday. Users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can run the exchange's verifier to confirm their balances are backed at least 1:1.
The FBI attributed the attack to North Korea. Tether reported about $1.57 billion in USDT frozen, and Circle said it had frozen more than $800 million in USDC in coordination with authorities. Bitcoin fell about 5% to below $77,000 in the hours after the attack. Binance has said it found additional points of breach beyond the initial compromise, which it originally attributed to a single engineer's laptop. The destination of roughly $3.3 billion in stolen funds that were not frozen has not been fully explained.