Binance is preparing to restore customer withdrawals in phases on Nov. 1 after saying it has replaced approximately 95% of the cryptocurrency stolen in a $6.3 billion attack, moving the exchange’s recovery effort toward a practical test: whether customers can move their money again.
The company’s Sunday update sets an initial reopening window of 06:00 to 09:00 UTC, or 1 a.m. to 4 a.m. Eastern Standard Time. Availability will be restored by asset and network, rather than across the entire platform at once. The announcement establishes a plan; it does not confirm that every listed withdrawal route is already operating.
The development shifts attention from the initial theft to the exchange’s ability to finance replacement assets, restore access and substantiate its assurances. Those are separate tests, and progress on one does not establish that the others are complete.
Restoring access in stages
The first phase includes bitcoin, ether, BNB, Solana, XRP, dogecoin and other assets. Reuters independently reported the reopening announcement and the increased replacement figure on Sunday. Binance says the remaining 5% consists of less-liquid tokens that take longer to buy in the quantities required.
The exchange warns that initial traffic could create delays or longer processing times. It directs customers to check the withdrawal page for the specific asset and network they intend to use. That qualification matters: support for a token on one blockchain does not imply that every route for moving it is available.
Replacement is different from recovery
Binance’s Saturday disclosure explains that replacement purchases draw on company resources, including part of its Secure Asset Fund for Users, part of its Futures Insurance Fund and its own funds. It pledged to absorb the financial impact rather than pass the stolen-asset losses to users.
Buying replacement tokens restores assets backing customer balances. It does not mean investigators have taken the original stolen cryptocurrency back from the attackers. The two processes can proceed in parallel, with the exchange financing its obligations while investigators and industry partners pursue the missing assets.
Binance says its emergency user-protection fund will be restored to approximately $1 billion. It also says the remaining futures insurance reserve continues to meet its risk-management requirements. These are statements by the company about its resources and protections, rather than an independent assessment of their adequacy.
The reserve figures need context
CoinDesk’s review of earlier reserve disclosures found that wallets drained in the attack were among those listed as backing customer holdings. Its Saturday reporting also distinguished the company funds earmarked to cover losses from assets frozen with help from industry partners.
The exchange published a new proof-of-reserves snapshot taken at midnight UTC on Oct. 31. Binance says balances for ten named assets are fully backed, while the associated cryptographic proof allowing customers to verify inclusion is expected Nov. 3. A snapshot, the later verification process and the status of withdrawals therefore represent different stages of its disclosure and recovery effort.
That distinction limits what can be concluded today. The company has reported substantial replenishment, but customers and counterparties still await further evidence about completion and the performance of restored services.
Investigators pursue the stolen assets
In an Oct. 31 cyber alert, the FBI attributed the theft to North Korean activity it calls TraderTraitor. The bureau, Secret Service and IRS Criminal Investigation said they had observed stolen assets being converted primarily into ether and expected further laundering through decentralized-finance and instant-swap services.
The agencies asked exchanges, blockchain operators, analytics firms and other providers to block transactions involving or derived from listed addresses. Their appeal is an effort to disrupt movement of the proceeds; it does not establish that all funds associated with those addresses have been seized or returned.
The alert identifies addresses that hold or previously held proceeds, or are operated by or closely connected to the actors. Its request extends to transactions derived from those addresses, reflecting the need to follow assets as they move. The FBI also invites relevant information through its field offices or Internet Crime Complaint Center.
What remains to be demonstrated
Longstanding SEC guidance cautions that proof-of-reserves reports are not equivalent to financial-statement audits. Such reports do not necessarily present a complete picture of liabilities and may lack the assurance, independence and oversight associated with an audit under applicable standards.
The SEC staff bulletin also notes that verification work can differ in scope and may provide no assurance about the reliability of the information presented. Even when an accounting firm is registered with the audit regulator, a particular reserve-verification engagement may fall outside its audit standards and oversight. The label attached to a report is therefore less informative than the work it actually covers.
That general warning does not determine Binance’s financial condition. It explains why a reserve snapshot alone cannot settle every question raised by a large theft. The immediate milestones remain clear: functioning withdrawal routes, replacement of the remaining affected tokens, completion of the promised verification material and the post-incident report Binance says it will publish after its investigation.
