Binance Reserves $6.34B and Targets a Sunday Withdrawal Restart

Binance put out a second update on its hot wallet theft on Friday, and the substance of it is money. The exchange says it has reserved more than $6.34 billion of company funds to cover the loss, and that roughly 80% of what was taken has already been replaced with the same coins. Withdrawals were still suspended on Saturday morning. They come back one token at a time once security checks and system changes are finished, and the accounts of when that happens do not agree. Deposits never stopped.

Four readings of one timetable

The update's own wording is "within approximately 34 hours, subject to the completion of security checks", and three outlets carried that phrase on Friday. CoinDesk read the same statement as a restart by Sunday, about 40 hours from the announcement. The Crypto Times headlined 45 hours. FinanceFeeds wrote 48. TokenPost reported separately that Richard Teng was targeting Sunday 1 November, which sits comfortably with the first two counts and settles nothing between them. None of the accounts says which hour it counts from. Restoration is phased either way, which is how Bitget brought withdrawals back one asset at a time in September.

Where the reserve sits

Of the money set aside against the $6.3 billion taken from the hot wallets, $5 billion is already held in the assets that went out the door: USDC, USDT, bitcoin, ether and BNB. The rest is being bought on exchanges and over the counter. Binance puts the amount frozen on chain at about $3 billion. Elliptic counted $2.84 billion as of 8 a.m. UTC on Friday, a figure only one outlet carried, and the two are different clocks as well as different counters. As published they do not reconcile.

"Binance will absorb the financial impact of these stolen funds, not our users," the update said.

It was signed by Yi He and Richard Teng, who run the company as co-chief executives.

The breach kept widening

"This was a complex attack," Teng said, adding that investigators had found additional points of breach and had not yet established the full sequence of events. The first theory was a compromised employee computer. Forbes describes that employee as a software engineer and Bitcoin.com News as a DevOps engineer; neither account sources the distinction. Binance says it has found no evidence that wallet private keys were leaked. The attackers ran a self-destruct mechanism that destroyed their tools and the traces of them, and exploited EIP-7702, an Ethereum feature that lets an ordinary address temporarily behave like a smart contract, to drive a hot wallet past the exchange's normal approval steps.

Teng said the attack hit Binance's own hot wallet and not customer funds. CoinDesk checked that against Binance's published reserve data and found the compromised wallets had previously been listed among the assets backing customer balances. Neither account confirms the other, and the reserve report due next week is where the question gets answered or does not.

Monday is the next checkpoint

An initial proof-of-reserves snapshot was promised within 12 hours of Friday's update, with the full report comparing platform holdings against customer balances due by Monday 2 November. Further verified technical findings were put at about 48 hours out, and a detailed post-mortem after that. Bitcoin traded at $77,175 early on Saturday, down 1.71% on the day, with BNB at $702.57 and ether barely moved. The market has stopped reacting to each new number out of the exchange. What it has not yet seen is a withdrawal going through.