Binance reopens withdrawals after replacing most of its $6.3bn loss from its own funds

Binance began reopening withdrawals on 1 November, less than three days after an attacker drained about $6.3bn from the world's largest crypto exchange. The first phase covers 15 blockchains, including those for bitcoin and ether and networks carrying the two main dollar stablecoins, Tether's USDT and Circle's USDC. Bitcoin reopened first, CNBC reported, followed by Ethereum and BNB Smart Chain, Binance's own network. Other coins will follow once checks are done. Deposits stayed open throughout, Binance says.

Binance has not got the stolen money back. It has bought replacements, on the open market and in private deals. On 30 October it said it had covered about 80% of the loss. By 31 October the figure was 90%, and by 1 November about 95%. Balances in ten large tokens, among them bitcoin, ether, USDT and USDC, are fully backed, it says. The missing 5% is in smaller tokens that are harder to buy in bulk. About $3bn of the stolen assets had been frozen where they sat by 30 October, and Binance says it is working with law enforcement to recover them.

The replacement money came from three places. One is SAFU, an emergency fund Binance set up in 2018 from a share of its trading fees. It is held by a clearing house regulated in Abu Dhabi. Another is part of the insurance fund for its futures market, where customers bet on prices with borrowed money. The rest came from Binance's own treasury. The exchange has not said how much each supplied. It has promised to rebuild SAFU to about $1bn.

The futures fund is the most delicate source. It exists to absorb the losses of traders whose bets go bust. When such a fund runs short, an exchange may instead cut back the positions of traders who are winning. Binance says it moved only money above the level its risk rules require, and that the rest of the fund is a regulatory requirement. It also concedes that no exchange can completely avoid such forced cuts in volatile markets. Swolecharts, a data tracker cited by the trade site crypto.news, put Binance's futures insurance funds at about $1.85bn on 1 November. Binance has not published the required minimum, so outsiders cannot tell how much room is left.

Binance took a new snapshot of its reserves at midnight UTC on 31 October. The full cryptographic proof, which lets each customer check that their own balance is backed one for one, is due by 3 November. On 30 October the exchange had said results would be ready by 2 November. Separately, the FBI said on 31 October that North Korea was behind the theft. It says the thieves are converting the loot mainly into ether, ready for further laundering through decentralised finance and instant-swap services. It has asked node operators, swap services and analytics firms to block transactions linked to addresses it listed.

How the attacker got in remains unexplained. Binance first said a compromised laptop might be involved. On 30 October it said it had since found other points of entry, and promised technical findings within about 48 hours. Its update on 1 November contained none, saying only that a full report would follow once the investigation is complete. Richard Teng, one of its two chief executives, has said the attack was more complex than the misuse of one engineer's access, CNBC reported.