Four days after the largest theft in crypto history, Binance reopened withdrawals on Sunday. The platform mobilized its own reserves to absorb a $6.3 billion shock — a sum that would have brought any other exchange to its knees.
Meanwhile, the FBI is pointing the finger at North Korea, Tether has frozen $1.57 billion in USDT, and users are scrutinizing every proof-of-reserves update. The second week of the crisis is shaping up to be decisive.
Here is what we know, backed by the numbers.
Phased Reopening: 15 Networks, $3.64 Billion in Net Outflows in Under 10 Hours
At 06:00 UTC on Sunday, Binance relaunched withdrawals starting with Bitcoin, before gradually extending access across 15 networks: ETH, BNB Smart Chain, Solana, XRP, Dogecoin, Tron, Polygon, Avalanche, Arbitrum, Base, Optimism, Zcash, TON, and Sui. A staged reopening, designed to prevent an uncontrolled rush on liquidity.
Between 06:00 and 15:30 UTC, the exchange processed approximately $4.65 billion in withdrawals against $1.01 billion in deposits, resulting in a net outflow of $3.64 billion. Measured against the $171 billion in assets reported in the latest proof of reserves at the end of October, that amounts to just 2.1% of the total — a signal that the user base did not succumb to full-blown panic.
Binance noted that temporary delays were possible during the initial volume spike, and that deposits remained open throughout the entire process. The platform also published a new proof-of-reserves snapshot dated October 31, allowing users to verify their individual balances through an open-source verifier. Assets covered include BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC.
SAFU, Treasury, Futures Fund: How Binance Financed Its Own Solvency
To cover the hole left by the hack, Binance drew from three distinct sources: the Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund, and its corporate treasury. The result: 95% of the impacted amount is now covered, according to the third recovery update published by the exchange.
The use of the futures fund raised legitimate questions within the community. Binance itself clarified that the remaining balance in that fund constitutes a regulatory requirement — meaning the room to maneuver on that line is structurally limited. The remaining 5% corresponds to less liquid tokens that fall outside the top 10 in the proof of reserves, and acquiring them at scale requires additional time. The exchange is working with industry partners and OTC desks to finalize these purchases.
A new snapshot covering a broader range of tokens is expected on November 4, with a zero-knowledge proof anticipated within 40 to 50 hours. A further withdrawal phase is also scheduled for Tuesday. Binance has reaffirmed that users will bear no financial losses as a result of the theft.
FBI, North Korea, Tether: The Investigation Accelerates on an International Scale
On the legal front, the FBI has officially attributed the attack to North Korea. The Lazarus Group, already responsible for the Ronin hack ($625 million in 2022) and several other major thefts, is firmly in the crosshairs of U.S. authorities. The U.S. Secret Service is collaborating with Circle to trace and freeze stolen funds held in USDC.
Tether announced the freezing of $1.57 billion in USDT linked to the attack, while Circle confirmed it had also carried out freezes on its end. These coordinated actions between stablecoin issuers and law enforcement represent an institutional response unprecedented in its scale — and potentially the fastest ever deployed in the aftermath of a crypto hack.
The hackers’ ability to convert or move the remaining funds will depend largely on how quickly bridges, DEXs, and mixers can be monitored or shut down. With state-level actors behind the attack, the high-stakes game between Binance, regulators, and Pyongyang is only just beginning.
