Binance Second Update: $6.34 Billion Cover, Phased Withdrawals in ~34 Hours, Proof of Reserves by 2 November

By TaazaPulse News Desk · Published: 30 October 2026 · TaazaPulse News Desk

What is new in Binance's second security incident update, published on Friday 30 October 2026, is the one thing users have been asking for since withdrawals froze on Thursday night: numbers with dates attached. The exchange says it has now reserved more than $6.34 billion of company money to cover the theft, that about $5 billion of it — roughly 80 percent of the replacement assets — is already held in the exact tokens that were taken, and that it is targeting the first phased reopening of withdrawals within about 34 hours of the update, with an initial Proof of Reserves snapshot inside 12 hours and the results published by Monday 2 November. This is an update to TaazaPulse's three earlier reports on this story — first the suspected hack on Thursday night, then Binance's confirmation of a roughly $6.3 billion breach, then the 48-hour resumption window — and its first paragraphs say what has changed: the cover is now quantified, the timeline is now narrower, and the proof users can check for themselves now has a date.

The money first, because it is the promise everything else rests on. Binance says it has set aside more than $6.34 billion in company funds through its Secure Asset Fund for Users and its corporate treasury, and that about $5 billion is already held in the same cryptocurrencies affected by the breach — USDC, USDT, bitcoin, ether and BNB. The exchange's own framing, reported by CryptoBriefing, is that it has therefore secured approximately 80 percent of the replacement assets in the required tokens and is buying the remainder through public markets and over-the-counter channels. The point of matching tokens rather than just matching dollar value is practical: affected user balances are to be restored one-for-one in the assets users actually held, not converted into something else. CoinDesk, which received the update directly from the exchange, reports the same structure — more than $6.34 billion set aside, $5 billion already in the affected tokens — and quotes the company saying that, ultimately, all user funds will be verified publicly through its Proof of Reserves. One caution belongs in the same paragraph as the promise: about $5 billion held is not the same as $6.34 billion restored, and the remaining fifth is still being bought at the time of writing. CertiK told Cointelegraph it needs more information to verify the $5 billion in matching tokens on-chain, which is exactly what the promised Proof of Reserves snapshot is meant to supply.

The timeline is the second half of the update, and it narrows rather than replaces the earlier guidance. On Friday morning, co-chief executive Yi He said the exchange expected to begin resuming withdrawals within 48 hours, a window that on a straight reading ran to about 04:17 UTC on Sunday 1 November. The second update targets the initial withdrawal reopening within approximately 34 hours of the update itself, in phases, with the timeline expressly subject to security reviews and validation of the affected systems. Co-CEO Richard Teng, in a video address on Friday, put the same target in plainer words: withdrawals back by Sunday. Readers should therefore treat Sunday 1 November as the target day under both framings, while understanding that "phased" is doing real work in the newer statement — the exchange has not promised that every user, on every network, will be able to withdraw at once. The earlier report on this site warned that wallet-incident recoveries usually restart network by network, often with lower limits at first, and nothing in the second update contradicts that expectation. A first reopened network will be the start of the process, not proof that it is finished.

The Proof of Reserves commitment is the part of the update that users can independently check, and it deserves to be read precisely. Binance plans to take an initial Proof of Reserves snapshot within 12 hours of the update and make the results available by 2 November, allowing customers to verify the assets backing their balances. CoinDesk's review of Binance's 1 October proof of reserves found the exchange's ETH reserve ratio at exactly 100 percent before the hack, and estimated that the ether backing fell to about 94 percent after roughly 204,500 ETH left the exchange — a gap the new snapshot will either close or expose. That is why the 2 November date matters more than the 34-hour one in one respect: a withdrawal restart shows the system working again, but only the reserves snapshot shows whether the money behind every balance is whole. Binance's spokesperson put it the same way in the company's own words: "We will continue to use company resources to cover confirmed shortfall… Ultimately, all user funds will be verified publicly through our Proof of Reserves."

What the update says about the attack itself is an honest revision of the first account, and the revision should be reported as such. Binance's first findings pointed to a compromised DevOps engineer's laptop, which gave an attacker access to a service container able to submit unauthorised withdrawal transactions. The second update says subsequent findings identified additional points of breach, and that the full sequence of events is not yet known. Teng added two technical details in his video address: the attacker used a self-destruct mechanism that destroyed tooling and traces along the way, and an EIP-7702 delegation — an Ethereum feature that lets an ordinary wallet temporarily run smart-contract code — that bypassed Binance's normal approval controls. Independent researchers have traced the attack to 50 EIP-7702 authorisations, one of which succeeded against Binance 14, a heavily used Ethereum hot wallet, with Etherscan data showing 167,464 ETH leaving that wallet at 20:24 UTC and a further 28,005.6 ETH from a second wallet, Binance 16. Binance says it has found no evidence that wallet private keys leaked. The full technical post-mortem the exchange has promised will show whether the compromised-laptop account survives scrutiny; until then, the mechanism is partly the exchange's account and partly independent on-chain analysis, and this article keeps those two labelled separately.

The other race — freezing what was stolen — has moved in parallel, and the figures here need the same care. Binance says about $3 billion in stolen assets has been frozen with the help of industry partners, a figure CoinDesk reports separately from the company's own reserves. That total includes more than $1.567 billion in USDT frozen by Tether, more than $800 million in USDC frozen by Circle, and $200 million halted with Ripple's help, as this site reported in the confirmation story. TRM Labs estimates the attacker still holds more than 420,000 ETH and 18,270 BTC, roughly $2.4 billion beyond any issuer's freeze, and the attacker is still moving funds: Arkham data cited by Decrypt shows a Tron wallet attributed to the hacker sending about 5.19 million TRX, worth roughly $1.73 million, to 12 addresses on Friday. The decentralised lending protocol Aave, where the attacker borrowed ETH against USDT while racing stablecoin freezes according to TRM Labs, said on Friday that it had unfrozen all of its V3 and V4 markets after freezing them as a precaution. Attribution remains where it was: TRM Labs and Chainalysis link the theft with high confidence to TraderTraitor, a North Korean hacking group, but Binance has not confirmed an attacker, and no government has done so either. This article continues to report attribution as analysts' assessment only.

For users, the practical position after the second update is clearer but not yet changed in the sense that matters most: withdrawals from Binance.com remain paused while the exchange completes its security checks, and deposits and other unaffected services continue to operate. The earlier warning from this site's first report stands unchanged, and the second update makes it more urgent rather than less: scammers move fast after exchange incidents, and a dated, specific timeline like "34 hours" and "2 November" gives them exact phrases to imitate. Rely only on Binance's official channels, ignore unofficial links, messages and requests for account information, and never send a password, a seed phrase or a payment to anyone promising to unlock frozen funds or jump the withdrawal queue. A genuine reopening will be announced by Binance, network by network, in public — it will not arrive as a private message, and no legitimate support agent will ask for credentials to release it. Pakistani users face exactly the same suspension as everyone else on Binance.com, and the same warning applies with extra force here, because this story has been among Pakistan's most searched topics since Thursday night.

Three things will tell readers whether this update's promises are being kept, and all three are worth watching rather than assuming. The first is the phased reopening itself: which networks and assets come back first, whether limits apply, and how long queues last for ordinary users rather than for the largest accounts. The second is the Proof of Reserves snapshot due by 2 November, and specifically whether it shows the ether and other token backing restored to whole — CoinDesk's estimate of about 94 percent ether backing after the hack is the number to compare it against. The third is the detailed technical post-mortem, which will show whether the compromised-laptop account survives scrutiny, whether the EIP-7702 element is confirmed, and what exactly was rebuilt during the pause. Alongside those three sits the still-open question of the roughly $3.3 billion that is neither frozen nor yet replaced — covered, Binance says, from company funds, but only the reserves snapshot will let users check that claim for themselves. One piece of context is worth keeping in view while waiting: Binance co-founder Changpeng Zhao has noted that while the $6.3 billion theft is the largest in dollar terms, it is not the largest in bitcoin terms, pointing to Mt. Gox's loss — a reminder that this record is measured in dollars at a moment when crypto prices are far higher than in any previous era of exchange failures. TaazaPulse will update this story the moment Binance announces that withdrawals have actually begun to reopen, or publishes its Proof of Reserves snapshot — whichever comes first.