31.10.2026 08:30
Following the approximately $6.3 billion cyberattack on cryptocurrency exchange Binance, withdrawals were halted. While it is claimed that North Korea may be behind the attack, millions of users are wondering when they can access their funds. Binance Co-CEO Richard Teng stated that customer funds are safe and losses will be covered from company resources, and announced that withdrawals are targeted to resume before Sunday.
The approximately $6.3 billion cyberattack targeting Binance, one of the world's largest cryptocurrency exchanges, has raised questions about when withdrawals will begin.
STATEMENT FROM BINANCE ON WITHDRAWALS
Following the cyberattack on cryptocurrency exchange Binance, work continues to restore users' access to withdrawals.
In a video message posted on his X account, Binance Co-CEO Richard Teng described the latest developments regarding the attack and the efforts underway to reopen the withdrawal service.
Teng thanked the business partners who acted quickly to freeze assets affected by the attack and the international law enforcement agencies that supported the investigation, and said they were pleased with users' patience and understanding.
"WE ARE DETERMINED TO COVER ALL LOSSES INCURRED AS A RESULT OF THE CYBERATTACK"
Richard Teng announced that company resources will be used so that the losses caused by the attack do not harm users.
Teng said, "We are determined to cover all losses incurred as a result of the cyberattack from our company funds. Your assets are safe."
Noting that Binance has set aside over $6.34 billion in company funds to cover the stolen assets, Teng reported that $5 billion of this amount is held in crypto assets directly affected by the attack, such as USDC, USDT, Bitcoin (BTC), Ethereum (ETH), and BNB.
He stated that the remaining amount will be covered through purchases made via market and over-the-counter (OTC) channels.
"BINANCE'S OWN HOT WALLET WAS AFFECTED IN THIS INCIDENT"
Arguing that the cyberattack did not affect customer funds, Teng explained that the security breach occurred in the company's own hot wallet.
Teng used the following statements regarding the matter:
"We never use customer funds, so these funds were not affected in any way. Binance's own hot wallet was affected in this incident. User assets are held under Binance's built-in security architecture. The vast majority of assets are stored in cold wallets and are transferred to the hot wallet only when a user performs a withdrawal."
Noting that Binance holds a significant portion of the earnings from its daily operations as crypto assets, Teng stated that the company is in a position to cover the losses arising from the attack with its own equity.
IS NORTH KOREA BEHIND THE ATTACK?
It was claimed that individuals linked to North Korea may be behind the approximately $6.3 billion attack.
However, no definitive information was disclosed regarding the identities of those who carried out the attack.
Richard Teng reported that the company's technology and security teams are continuing comprehensive investigations to uncover how the attack was carried out.
"THIS ATTACK WAS NOT CARRIED OUT BY A SINGLE PERSON"
Noting that the cyberattack had a highly complex structure, Teng said, "This attack was not carried out by a single person."
Teng stated that initial investigations assessed that a seized laptop may have played a role in the security breach, and said that further research identified other points of security breach.
Noting that the attackers used a mechanism that eliminated the tools and traces they left behind during the process, Teng stated that this made it difficult to determine the source of the attack.
EIP-7702 PROTOCOL WAS USED IN THE ATTACK
In the technical investigations conducted by Binance, it was stated that the attackers used the EIP-7702 protocol to obtain authorization to perform on-chain transactions on the hot wallet.
Teng stated that the authorization in question did not pass through normal approval control mechanisms.
Explaining that the withdrawal service was stopped for this reason, Teng reported that the company had to comprehensively examine, rebuild, and test its infrastructure systems.
He emphasized that withdrawals will resume only after security tests are successfully completed.
WHEN WILL WITHDRAWALS BEGIN?
Clarifying the issue most curious to Binance users, Teng announced that work to reopen the withdrawal service is expected to be completed within approximately 40 hours.
Teng said, "We hope that users will be able to withdraw before our deadline of Sunday, within the scope of work expected to be completed within 40 hours."
Thus, it was stated that the goal is for withdrawals to resume before Sunday, but the exact opening depends on the completion of security work.
PROOF OF RESERVES REPORT WILL BE PUBLISHED ON MONDAY
Following the attack, Binance's security teams are comprehensively examining the company's infrastructure, including endpoints, cloud systems, key management, and signing processes.
Richard Teng announced that the purchases to cover the stolen assets will be completed and the company's reserve status will be shared with the public.
Teng reported that they aim to publish a comprehensive "Proof of Reserves" report by Monday and will inform users before the report.