Binance US$6.3bn hack: US$4.72bn customer outflow and new reserve proof

Binance customers have withdrawn a net US$4.72bn from the cryptocurrency exchange since withdrawals began reopening following a US$6.3bn theft, as the company published new cryptographic evidence of its asset reserves on Monday.

The net outflow, confirmed by Binance to Reuters, represents approximately 2.8% of assets held on the platform. It follows the compromise of the exchange’s hot wallets on 29 October and the suspension of withdrawals for approximately 48 hours.

The stolen assets and subsequent customer withdrawals are separate figures. The former represents funds taken by attackers, while the latter measures deposits leaving the platform, net of incoming funds, after customers regained access.

Binance said on 2 November that it had completed the zero-knowledge proof supporting a reserves snapshot taken on 31 October. Customers holding ten major tokens, including bitcoin, ether, USDT, USDC and BNB, can now independently verify that their balances were backed at least one-to-one at the snapshot date.

The exchange also said it had replenished approximately 95% of the assets affected by the theft using its own resources, insurance funds and other available reserves. The outstanding 5% comprises less liquid tokens that remain more difficult to replace.

Replenishment should not be confused with recovery of the stolen cryptocurrency. Binance has separately reported that approximately US$3bn of assets linked to the attack were frozen on-chain, with investigations continuing.

The cause of the breach also remains under investigation. Binance initially identified a compromised employee laptop as a possible entry point but subsequently uncovered additional points of compromise. It has reported no evidence that wallet private keys were leaked.

Nauman Abuzar, VP of Risk and Compliance at fraud prevention company SEON, warned that “controls that only kick in once a transaction starts may already be too late”.

The incident raises a broader question for banks, payment providers and fintech platforms about the relationship between privileged access, transaction authorisation and financial crime monitoring. A transaction can appear operationally valid even when the infrastructure authorising it has been compromised.

Binance plans further phased withdrawal restoration from 3 November and another reserves snapshot on 4 November. The immediate test is whether it can restore full access while demonstrating that customer assets remain adequately backed.