Binance reopens withdrawals: who paid for the $6.3B hack

Binance is letting customers take their money out again. Overnight into November 1, the exchange said phase one of withdrawals would open on Sunday between 06:00 and 09:00 UTC (Binance, Recovery Update #4). Withdrawals have been frozen since October 29, when roughly $6.3 billion was drained from its hot wallets. The interesting question is no longer when the doors reopen. It's who paid to refill the vault, and what that changed for anyone trading futures there.

What reopens first

Phase one covers 15 networks: Bitcoin, Ethereum, BSC, Tron, Solana, XRP Ledger, Zcash, Dogecoin, TON, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism and Sui, with USDT and USDC available on several of them. Binance ranked them by customer demand over the past week and says each network goes live only after its security checks clear. Everything else comes later, as it's ready. There is no date for phase two. Deposits stayed open throughout.

The exchange is already warning about delays and failed withdrawals in the first hours, and says to simply retry. That's no surprise: three days of pent-up demand to move funds is about to hit a single window.

Who actually paid

Binance says it has now replaced about 95% of the stolen assets, up from 90% a day earlier (Reuters). It's buying the missing coins on the open market and through OTC desks. The last 5% is tokens outside the top ten, which are thinner and harder to source in size.

Update #3 shows where the money came from: part of the SAFU fund, part of the futures insurance fund, and the company's own treasury. SAFU is the emergency reserve Binance has been building from trading fees since 2018, and the exchange says it will top it back up to about $1 billion. Reuters, via NBC News, reports the same three sources.

Why futures traders should care about the insurance fund

The insurance fund doesn't cover your losses. Per Binance's own explainer, it only covers the gap between a liquidated position's bankruptcy price and the price the liquidation engine actually got. When price moves faster than the engine can close a position, the fund eats the shortfall.

When the fund can't, auto-deleveraging (ADL) kicks in. The exchange forcibly trims positions on the other side of the trade, starting with the most leveraged and most profitable ones. So on a violent day, you can lose part of a winning position through no mistake of your own, simply because someone else went bust.

Binance says it only took the excess above the required minimum and that the fund is still above that level. It also concedes that, with volatility, no exchange can fully rule out ADL. The fund balance is public and updates daily at 00:00 UTC. USDT-margined BTC, ETH and BNB contracts share one fund.

What to watch next

First, how much money leaves once withdrawals open, and whether the rails hold. Second, the full proof of reserves. The snapshot was taken at 00:00 UTC on October 31. The zero-knowledge proof takes 40 to 50 hours to generate and is expected by Tuesday, November 3. It will let each user check that their balance in the ten main coins is backed at least 1:1. Other tokens aren't covered by that check.

Third, the stolen funds themselves. On October 31 the FBI formally named North Korea's TraderTraitor group as the attacker. It says the loot is being converted mostly into ETH and will be laundered through DeFi and instant-swap services. The notice lists more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address, and Chainalysis' CEO expects that to grow to tens of thousands of addresses in the coming weeks (CoinDesk).

Daily market data on X: @tarvis_trade