The exchange plans to resume withdrawals in phases, publish updated Proof of Reserves data and recover stolen assets as it works to restore customer confidence.
Binance plans to begin restoring withdrawals within approximately 34 hours and publish an updated Proof of Reserves report by Monday, November 2, as the exchange works to recover from a $6.3 billion security breach.
In its second security incident update, published Friday, the exchange outlined four immediate priorities, including phased withdrawal restoration, verification of customer reserves, recovery of frozen assets and publication of a technical report explaining the attack.
Binance said its technical team is targeting the initial withdrawal reopening within 34 hours of the update, although the timeline remains subject to security reviews and validation of affected systems.
The exchange also plans to take an initial Proof of Reserves snapshot within 12 hours and make the results available by November 2, allowing customers to verify the assets backing their balances.
The announcement follows an October 29 attack that compromised Binance hot wallets and resulted in approximately $6.3 billion in unauthorized withdrawals, making it the largest cryptocurrency theft on record.
“Binance will absorb the financial impact of these stolen funds, not our users,” the company said.
Binance commits $6.34B to cover losses as recovery continues
Binance said it has set aside more than $6.34 billion in company funds to cover the stolen assets through its Secure Asset Fund for Users and corporate treasury.
Of that amount, approximately $5 billion is already held in the same cryptocurrencies affected by the breach, including USDT, USDC, Bitcoin, Ethereum and BNB.
The exchange said it has therefore secured approximately 80% of the replacement assets in the required tokens and is purchasing the remainder through market and over the counter transactions.
Binance has also worked with law enforcement, blockchain intelligence firms and token issuers to trace and freeze approximately $3 billion in stolen assets.
The frozen funds are separate from the company’s committed replacement resources, and recovery efforts remain ongoing.
The exchange said it would pursue available avenues to identify those responsible and recover the stolen assets.
Binance investigation uncovers additional security breaches
Binance said its initial investigation suggested that the attack may have involved a compromised employee laptop, but subsequent findings identified additional points of breach.
The exchange has not found evidence that wallet private keys were leaked, although investigators are still working to establish the full sequence of events.
The attack began around 20:05 UTC on October 29, when compromised hot wallet infrastructure allowed unauthorized withdrawals.
Binance said it has contained the affected infrastructure, revoked compromised authorizations and implemented additional security controls.
Withdrawals remain suspended while the exchange conducts further security checks, but deposits and other unaffected services continue operating.
The company expects to share additional verified technical findings within approximately 48 hours.
It also plans to publish a detailed incident postmortem outlining how the attack occurred, the vulnerabilities involved and the security measures implemented to prevent similar incidents.
