Binance Refreshes Reserve Wallet Addresses and Reopens Withdrawals Following Record $6.3B Breach
Binance has updated its Proof of Reserves wallet list and initiated a phased reopening of customer withdrawals following a massive hot wallet breach.
Binance Refreshes Reserve Wallet Addresses and Reopens Withdrawals Following Record $6.3B Breach
Binance has updated its Proof of Reserves wallet list and initiated a phased reopening of customer withdrawals following a massive hot wallet breach.
Proof of Reserves Address Refresh and Customer Verification
Binance has published a refreshed list of addresses for its Binance Proof of Reserves program, establishing new wallet infrastructure to handle all future customer funds. The exchange completed a reserve snapshot on October 31, 2026, at 00:00 UTC, which reported full backing across ten major assets, including Bitcoin at 100.04% and BNB at 101.30%. Customers can download the full address list directly to verify published balances against on-chain data.
To further confirm that user accounts are fully backed, Binance plans to deliver a zk-SNARKs cryptographic proof by November 3, 2026. This system will allow individual users to independently verify that their specific account balances are included in the overall reserve calculations.
Phased Restoration of Account Withdrawals
Following a temporary pause after the security incident, Binance began restoring customer withdrawals in phases on November 1, 2026. Outbound transactions initially resumed for Bitcoin before expanding across 15 total networks. The exchange reopened withdrawals for USDC, USDT, and ETH on Ethereum, as well as USDC, USDT, and BNB on BNB Smart Chain. Deposit functionality remained active continuously throughout the incident.
Binance executives, including Co-CEO Richard Teng, confirmed that the exchange is absorbing the full financial impact of the event and that customer balances remain secure. Binance allocated more than $6.34 billion from corporate funds and its Secure Asset Fund for Users (SAFU) to replenish affected assets, bringing asset restoration to between 90% and 95% by the time withdrawals resumed. Users have been cautioned to expect potential processing delays due to high demand during the initial restoration wave.
Scope of the Hot Wallet Breach and On-Chain Asset Movement
The security breach occurred between October 29 and October 30, 2026, when unauthorized entities drained approximately $6.3 billion from internet-connected hot wallets spanning roughly 10 blockchain networks. The FBI has attributed the attack to TraderTraitor, a North Korean state-linked cyber group associated with the Lazarus Group. In response to the theft, Binance and external partners have frozen or located approximately $3 billion of the stolen funds, primarily involving dollar-pegged stablecoins.
While stablecoin issuers possess technical mechanisms to freeze targeted addresses, unfreezable native digital assets stolen in the attack remain under active monitoring. On November 1, 2026, blockchain tracking service Whale Alert reported that a wallet tied to the attack transferred 485,270 SOL—valued at approximately $46 million—to an unidentified address. This transaction accounts for roughly half of the 970,500 SOL originally taken during the incident.
About The Author
