{"id":33428,"date":"2026-11-02T15:50:12","date_gmt":"2026-11-02T15:50:12","guid":{"rendered":"https:\/\/investx.fr\/en\/2026\/11\/02\/binance-hack-withdrawals-reopen-95-percent-funds-covered\/"},"modified":"2026-11-02T15:50:20","modified_gmt":"2026-11-02T15:50:20","slug":"binance-hack-withdrawals-reopen-95-percent-funds-covered","status":"publish","type":"post","link":"https:\/\/investx.fr\/en\/crypto-news\/binance-hack-withdrawals-reopen-95-percent-funds-covered\/","title":{"rendered":"Binance Hack: Withdrawals Reopen, 95% of Funds Covered \u2014 But the North Korean Threat Looms"},"content":{"rendered":"\n

Four days after the largest theft in crypto history, Binance<\/strong> reopened withdrawals on Sunday. The platform mobilized its own reserves to absorb a $6.3 billion<\/strong> shock \u2014 a sum that would have brought any other exchange to its knees.<\/p>\n\n\n\n

Meanwhile, the FBI<\/strong> is pointing the finger at North Korea<\/strong>, Tether<\/strong> has frozen $1.57 billion in USDT<\/strong>, and users are scrutinizing every proof-of-reserves update. The second week of the crisis is shaping up to be decisive.<\/p>\n\n\n\n

Here is what we know, backed by the numbers.<\/p>\n\n\n\n

Phased Reopening: 15 Networks, $3.64 Billion in Net Outflows in Under 10 Hours<\/h2>\n\n\n\n

At 06:00 UTC on Sunday<\/strong>, Binance<\/strong> relaunched withdrawals starting with Bitcoin<\/strong>, before gradually extending access across 15 networks<\/strong>: ETH<\/strong>, BNB Smart Chain<\/strong>, Solana<\/strong>, XRP<\/strong>, Dogecoin<\/strong>, Tron<\/strong>, Polygon<\/strong>, Avalanche<\/strong>, Arbitrum<\/strong>, Base<\/strong>, Optimism<\/strong>, Zcash<\/strong>, TON<\/strong>, and Sui<\/strong>. A staged reopening, designed to prevent an uncontrolled rush on liquidity.<\/p>\n\n\n\n

Between 06:00 and 15:30 UTC, the exchange processed approximately $4.65 billion in withdrawals<\/strong> against $1.01 billion in deposits, resulting in a net outflow of $3.64 billion<\/strong>. Measured against the $171 billion<\/strong> in assets reported in the latest proof of reserves<\/a> at the end of October, that amounts to just 2.1% of the total<\/strong> \u2014 a signal that the user base did not succumb to full-blown panic.<\/p>\n\n\n\n

Binance<\/strong> noted that temporary delays were possible during the initial volume spike, and that deposits remained open throughout the entire process. The platform also published a new proof-of-reserves<\/strong> snapshot dated October 31<\/strong>, allowing users to verify their individual balances through an open-source verifier. Assets covered include BTC<\/strong>, ETH<\/strong>, USDT<\/strong>, BNB<\/strong>, SOL<\/strong>, USDC<\/strong>, XRP<\/strong>, USD1<\/strong>, RLUSD<\/strong>, and ZEC<\/strong>.<\/p>\n\n\n\n

\"Binance<\/figure>\n\n\n\n

SAFU, Treasury, Futures Fund: How Binance Financed Its Own Solvency<\/h2>\n\n\n\n

To cover the hole left by the hack, Binance<\/strong> drew from three distinct sources: the Secure Asset Fund for Users (SAFU)<\/strong>, a portion of its futures insurance fund<\/strong>, and its corporate treasury<\/strong>. The result: 95% of the impacted amount<\/strong> is now covered, according to the third recovery update published by the exchange<\/a>.<\/p>\n\n\n\n

The use of the futures fund raised legitimate questions within the community. Binance<\/strong> itself clarified that the remaining balance in that fund constitutes a regulatory requirement<\/strong> \u2014 meaning the room to maneuver on that line is structurally limited. The remaining 5%<\/strong> corresponds to less liquid tokens that fall outside the top 10 in the proof of reserves<\/strong>, and acquiring them at scale requires additional time. The exchange is working with industry partners and OTC desks to finalize these purchases.<\/p>\n\n\n\n

A new snapshot covering a broader range of tokens is expected on November 4<\/strong>, with a zero-knowledge proof<\/strong> anticipated within 40 to 50 hours<\/strong>. A further withdrawal phase is also scheduled for Tuesday. Binance<\/strong> has reaffirmed that users will bear no financial losses<\/strong> as a result of the theft.<\/p>\n\n\n\n

FBI, North Korea, Tether: The Investigation Accelerates on an International Scale<\/h2>\n\n\n\n

On the legal front, the FBI has officially attributed the attack to North Korea<\/strong>. The Lazarus Group<\/strong><\/a>, already responsible for the Ronin<\/strong> hack ($625 million in 2022) and several other major thefts, is firmly in the crosshairs of U.S. authorities. The U.S. Secret Service<\/strong> is collaborating with Circle<\/strong> to trace and freeze stolen funds held in USDC<\/strong>.<\/p>\n\n\n\n

Tether<\/strong> announced the freezing of $1.57 billion in USDT<\/strong> linked to the attack, while Circle<\/strong> confirmed it had also carried out freezes on its end. These coordinated actions between stablecoin issuers<\/strong> and law enforcement represent an institutional response unprecedented in its scale \u2014 and potentially the fastest ever deployed in the aftermath of a crypto hack<\/a>.<\/p>\n\n\n\n

The hackers’ ability to convert or move the remaining funds will depend largely on how quickly bridges<\/strong>, DEXs<\/strong>, and mixers<\/strong> can be monitored or shut down. With state-level actors behind the attack, the high-stakes game between Binance<\/a>, regulators, and Pyongyang<\/strong> is only just beginning.<\/p>\n\n\n\n

\n\n\n\n

Related articles :<\/h3>\n\n\n\n