Binance faces $3.75 billion withdrawal claim after reopening

Binance has begun restoring cryptocurrency withdrawals following a $6.3 billion security breach, as an unverified claim that customers withdrew more than $3.75 billion within ten hours raised fresh questions about the scale of outflows from the world’s largest cryptocurrency exchange.

The figure circulated on Sunday after Binance reopened withdrawal services in phases. However, the exchange has not publicly confirmed the amount, and independently verified blockchain data establishing the precise ten-hour total was unavailable. The distinction is significant because transfers between exchange-controlled wallets can complicate estimates of customer withdrawals.

Binance announced that withdrawals would resume between 06:00 and 09:00 UTC on November 1, following security assessments conducted after hackers targeted its cryptocurrency wallets. The company said restoration would proceed gradually, with individual networks requiring security and operational checks before becoming available.

The exchange confirmed that bitcoin withdrawals were among the first services restored. Other supported assets included ether, BNB, solana, XRP, dogecoin and several dollar-pegged stablecoins. Additional cryptocurrency networks were scheduled for restoration as technical checks progressed.

Binance said it had replenished approximately 95 per cent of the assets affected by the attack, increasing its replacement coverage from 90 per cent announced a day earlier. The company maintained that customers would not bear losses arising from the theft.

The remaining five per cent comprised comparatively illiquid cryptocurrencies that were proving more difficult to purchase in sufficient quantities. Binance said it was sourcing these assets through market transactions and over-the-counter arrangements.

The exchange had previously allocated more than $6.34 billion of corporate resources to cover the stolen assets. Its recovery programme involves replacing affected holdings while pursuing efforts to identify attackers and recover funds transferred during the breach.

The reopening followed a suspension imposed after the October 29 attack, which affected cryptocurrency holdings across multiple blockchain networks. Binance described the interruption as a precautionary measure necessary to assess compromised systems, contain potential risks and verify the safety of withdrawal infrastructure.

Blockchain intelligence company TRM Labs estimated the theft at approximately $6.36 billion. Its analysis identified stolen bitcoin, ether, stablecoins, XRP and solana among the affected assets.

The company attributed the intrusion to TraderTraitor, a hacking operation linked to North Korea. Binance has said it is cooperating with law enforcement and blockchain intelligence specialists to trace stolen assets and establish responsibility.

The distinction between stolen funds and customer withdrawals remains important. The $6.3 billion figure represents assets compromised during the cyberattack, while the reported $3.75 billion refers to alleged customer transfers following the restoration of withdrawal services. These amounts describe separate transactions and should not be combined.

Large cryptocurrency exchanges routinely process substantial transfers involving customers, institutional counterparties and their own treasury wallets. Consequently, gross blockchain movements do not necessarily represent equivalent reductions in customer deposits or exchange reserves.

Determining actual withdrawals requires identifying exchange-controlled addresses, separating internal transfers from customer transactions and accounting for deposits entering the platform during the same period. Such analysis also depends on accurately identifying the beginning and end of the measurement window.

Binance has sought to reassure customers by publishing information about its reserves and the replacement of affected assets. The company stated that balances in major cryptocurrencies, including bitcoin, ether, BNB, solana and several stablecoins, were fully backed.

Its proof-of-reserves disclosures are intended to demonstrate the relationship between customer balances and assets held by the exchange. Nevertheless, reserve snapshots represent holdings at particular points and cannot independently establish the value of withdrawals processed over a subsequent ten-hour period.

The exchange said deposits remained operational throughout the withdrawal suspension. This meant customers could continue transferring cryptocurrency into Binance even while outbound transactions were temporarily restricted.

Binance also warned that customers might encounter processing delays during the initial restoration because of transaction volumes and the gradual activation of supported networks.

The company advised customers to check the availability of individual cryptocurrencies and blockchain networks before submitting withdrawal requests. Transactions involving networks awaiting approval would remain restricted until their security assessments were completed.

Binance said it would continue monitoring platform performance and transaction processing as services returned. Its technical teams were conducting additional checks on affected infrastructure while working with external partners on asset recovery.

The exchange has also committed to publishing a detailed report explaining the security incident after its investigation is completed. That document is expected to address the circumstances of the breach and the safeguards introduced during restoration.

The initial reopening covered selected assets across networks including Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Polygon, Avalanche, Arbitrum, Base, Optimism and Sui.