Binance should reopen with less Bitcoin exposed to its withdrawal system

Binance says 90% of stolen assets are replaced, with withdrawals targeted for 1 November

Binance says it has replaced 90% of the assets stolen in the hack, up from 80%. It reports full backing for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, ZEC, while purchases of the remaining, less-liquid assets continue.

Binance says the replacement funds come from its treasury, SAFU and part of its futures insurance funds, and plans to restore SAFU to approximately $1 billion. Its new Proof of Reserves snapshot is dated 31 October, 00:00 UTC. The full zero-knowledge proof is expected by 3 November UTC, after the planned withdrawal restart. Binance’s update on X ↗ · Full announcement ↗

Replacing the stolen assets covers the losses. Binance also needs to reduce what another compromise could reach. We will measure that exposure through operating balances, transfers into cold storage and the funds supplied to withdrawal wallets.

Binance’s withdrawal wallet held 19,111 BTC when the hack began

The affected Bitcoin address served as a withdrawal wallet, receiving funds from Binance’s deposit addresses and reserve wallets before making outgoing payments.

Immediately before the hack, it held 19,111 BTC. Eleven attacker payments removed 18,270 BTC—95.6% of its balance—in one block on 29 October.

Over the following 55 minutes, eight transfers from Binance’s deposit addresses delivered another 970 BTC to that same wallet. Binance then fought back by moving 1,770 BTC into its established cold wallet, leaving 0.37 BTC in the compromised withdrawal wallet. Follow the transaction sequence →

The continuing refills show why the balance at the start of an attack is only part of the exposure. A smaller withdrawal wallet can still make more money available to an attacker if deposit forwarding and reserve transfers keep funding it.

Spending limits must cover related payments and the funds supplied to make them. Once the limit is reached, further payments or refills should require independent approval. The service requesting a payment must not be able to approve exceptions to its own limits.

Binance already had a cold-storage route. It should use it sooner.

Three days before the hack, Binance transferred approximately 7,640 BTC to its known cold wallet. Removing funds from the withdrawal wallet was already part of its operations. The reopening gives Binance an immediate opportunity to keep less Bitcoin there and move excess funds out sooner.

This wallet handled substantial operating volume. In the 30 days before the hack, its busiest rolling 20-minute period contained 4,286 BTC in external payments, excluding change and known Binance destinations.

The attacker removed more than four times that historical peak in one block.

Historical payment demand gives Binance a basis for setting smaller operating balances and controlled replenishment. It needs enough Bitcoin available to serve customers, without allowing unusually large balances to remain exposed between payment cycles.

Reopening will also release demand that has built up during the suspension. Binance should process delayed withdrawals in controlled stages, with a defined amount exposed at each stage. We will compare the early outflows with the wallet’s ordinary payment history and Binance’s announced reopening steps.

Cold-storage transfers need independently approved destinations and controls appropriate to reserve management. Binance should be able to remove excess funds promptly without allowing an unrestricted internal-transfer exemption to become another way around its safeguards.

The operational goal is to maintain payment capacity while reducing both the balance exposed at one time and the additional funds a compromised service could obtain.

We will measure how much Bitcoin Binance keeps exposed.

When Binance starts moving the held deposits, we will trace those funds into the wallets funding withdrawals. From there, we will follow outgoing payments and replenishment across repeated cycles.

For each cycle, we will report how much of the waiting Bitcoin moves, where it goes, and whether outgoing payments continue as Binance replenishes the wallets. We will compare the amount and timing of each refill with subsequent payments and transfers into cold storage.

We will track funds held before reopening separately from new deposits. That will show how much of the waiting Bitcoin Binance moves, even if fresh deposits keep the total balance growing.

We will compare payments to familiar exchanges and recurring recipients with their previous amounts and timing. We will also profile new destinations and follow changed routes as their activity develops.

We will compare average and peak operating balances with the 29 September–29 October history, measure time spent above the 14,736-BTC historical average and trace transfers into cold storage. Following both funding and spending will show how much Bitcoin is available across each complete cycle.

These are the changes we will look for as Binance reopens: less Bitcoin kept in withdrawal wallets, earlier transfers into cold storage and controlled refills that support payments. Binance’s technical report should explain the independent controls enforcing those boundaries.