Binance to Begin Resuming Withdrawals Within 48 Hours After $6.3 Billion Hack

By TaazaPulse News Desk · Published: 30 October 2026 · TaazaPulse News Desk

What changed on Friday morning is the one thing Binance had refused to give since Thursday night: a time. In a service update posted on X at 04:17 UTC on 30 October 2026 — 09:17 in Pakistan — Binance co-chief executive Yi He said the exchange expects to begin resuming withdrawal services within the next 48 hours, while deposits remain unaffected and continue to operate normally. Nineteen minutes later, at 04:36 UTC, Binance's main account confirmed the timeline in its own words: withdrawals remain paused while the team completes a security revamp of the withdrawal service and its related addresses, and the exchange expects to resume within 48 hours. This is a follow-up to TaazaPulse's two earlier reports on this story — first the suspected hack on Thursday night, then Binance's confirmation of a roughly $6.3 billion breach — and its first two paragraphs say what is new here: for the first time since withdrawals were halted, users have a window, not just a condition. What the new statements do not give is a date for full restoration, a list of which networks or assets will reopen first, or an explanation of an apparent contradiction about deposits, and this article keeps all three gaps visible rather than filling them in.

The 48-hour window matters because of what came before it. When Binance confirmed the breach in its late-Thursday statement, it said withdrawals and deposits were suspended and gave no resumption time at all — services would return, it said, once the security issue was resolved. That is a condition, not a timetable, and for users locked out of their accounts it was the least useful sentence in an otherwise unusually frank statement. Yi He's update replaces that open-ended condition with a starting point: the exchange expects to begin resuming withdrawals within 48 hours of her post, which on a straight reading runs to about 04:17 UTC on Sunday 1 November, or about 09:17 PKT that morning. FinanceFeeds, which first parsed the timeline, notes that the window means customers could in total be locked out of withdrawals for up to about 54 hours, counting from the original halt at 22:15 UTC on Thursday. The distinction between beginning and finishing is the most important reading point in the whole update. Binance has not promised that every user, on every network, will be able to withdraw within 48 hours; it has promised that the resumption process should start within that window. Anyone reporting this as "Binance reopens in 48 hours" is overstating what was actually said.

What is being fixed, according to Yi He, is the withdrawal service itself and its related address controls. That wording connects directly to Binance's own account of the breach, which this site reported in its confirmation follow-up: a compromised DevOps engineer's laptop gave an attacker access to a service container that could submit unauthorised withdrawal transactions, and Binance said it had revoked the affected address authorisation and found no evidence of any wallet private key leak. Rebuilding address controls in that setting is more than rotating a password or patching a single flaw. Binance has to confirm that every hot wallet is clear of foreign delegations — the mechanism independent researchers linked to Ethereum's EIP-7702 feature, which lets an ordinary wallet temporarily hand control to smart-contract code — and that the service allowed to request withdrawals can no longer be reached from an engineer's machine. A 48-hour target suggests Binance expects that work to be a rebuild of the withdrawal pathway, not a quick patch, and the exchange's own word for it, "revamp", points in the same direction. Until Binance publishes its promised detailed technical post-mortem, the full list of what is being rebuilt remains the exchange's summary, not a verified reconstruction, and this article reports it as such.

There is also a deposit discrepancy in the new statements that Binance has not yet explained, and honest reporting should not smooth it over. At 00:13 UTC on Friday, Binance said all deposits and withdrawals were temporarily suspended. Its investigation update at 02:25 UTC again listed temporarily suspended deposits and withdrawals among its precautions. Yi He now says deposits remain unaffected and continue to operate as normal, and the main Binance account repeated that deposits remain unaffected. Either deposits were quietly restored in the intervening hours, or the earlier suspension was narrower than the wording suggested. FinanceFeeds, which spotted the conflict, notes that Binance's main account has not clarified which of those is true. The distinction is not academic. An exchange that accepts deposits while withdrawals are frozen is taking on new exposure from customers who cannot yet leave, and that puts extra weight on Binance's promise to cover all losses and on the updated Proof of Reserves it says it will publish after remediation. Until Binance clarifies the deposit timeline, readers should treat the current position as stated in the latest posts — deposits described as operating normally, withdrawals paused — and should be aware that the earlier posts said something different. That is not an accusation of bad faith; large exchanges revise their status wording during fast-moving incidents, and Binance's first statement on Thursday night was itself edited twice in 13 minutes. It is, however, a reason to follow the exchange's official channels rather than any single screenshot.

The market read the update as relief, but not as resolution. At 04:24 UTC on Friday, shortly after Yi He's post, BNB was trading at $716.15, down 4.2 percent over 24 hours, according to CoinGecko figures cited by FinanceFeeds — a sharp improvement on the more than 8 percent fall recorded before Binance disclosed the cause and funding source of the loss in its confirmation statement. Bitcoin was at $78,120 at the same moment, down 2.1 percent over 24 hours, above the below-$77,000 level reached on Thursday evening when CoinDesk recorded a 4.8 percent fall. Those levels are a snapshot from Friday morning, not a verdict on where prices will settle, and they moved again through the day as traders weighed the same question users are asking: does a 48-hour start date make the frozen funds safer, or does it simply start a longer, messier process? About $3 billion of the roughly $6.3 billion impact is frozen, according to Binance, a figure that has risen steadily through the night from the $2.54 billion reported on Thursday evening. The roughly $3.3 billion gap will be covered, Binance says, from its Secure Asset Fund for Users, which holds roughly $1 billion in bitcoin, plus company funds. CoinDesk's live coverage also reported that the Arbitrum Security Council took emergency action to freeze 74.56 million Arbitrum tokens held in the hacker's wallet, moving them to an intermediary frozen wallet that only further Security Council action or an Arbitrum DAO governance vote can release. That freeze is part of the wider race to stop the stolen funds moving, not a separate recovery, and it underlines how much of the remaining money can only be stopped network by network, issuer by issuer.

For users, the practical position on Friday morning is therefore better defined but not yet better in the sense that matters most: money still cannot be withdrawn from Binance.com. What has improved is the information. Users now know the exchange is working to a 48-hour start window, that it describes the work as a security revamp of withdrawals and related address controls, and that it continues to describe deposits as operating normally. What has not changed is the rest of the verified picture from the confirmation story: the breach is about $6.3 billion, the largest crypto theft on record, more than four times the $1.5 billion Bybit theft of February 2025; about $3 billion is frozen, including about $2.3 billion in USDT and USDC stablecoins, with Tether freezing more than $1.567 billion in USDT, Circle more than $800 million in USDC, and Ripple helping halt $200 million; Binance pledges to cover all losses; and Binance.US, the separately operated American platform, says it is unaffected and operating normally. The attribution question is also unchanged: blockchain-intelligence firms including TRM Labs, which says it has high confidence in a North Korean TraderTraitor link, and independent investigator ZachXBT, who points to the Lazarus Group, have pointed in one direction, but no official body — not Binance, not any government — has confirmed an attacker, and this article continues to report attribution as analysts' assessment only.

What should users expect when the window opens? Binance has not said, so the honest answer separates what the exchange has promised from what usually happens in wallet-incident recoveries. What Binance has promised is a beginning within 48 hours. What exchanges recovering from wallet incidents usually do, as FinanceFeeds notes, is restart withdrawals network by network, starting with the chains where hot-wallet controls have been rebuilt and checked, often with lower limits at first. Clients should therefore expect queues and delays for large withdrawals even after the first networks come back, and should not treat the first reopened network as proof that all networks are safe. There is also a practical warning that applies with extra force while deposits are described as normal and withdrawals are not: depositing fresh funds into an account from which you cannot yet withdraw increases your exposure to that same paused system, whatever your reason for depositing. That is not financial advice, and it is not a claim that Binance will fail — the exchange's size, its roughly $144 billion in platform assets before the hack according to DefiLlama data cited by CoinDesk, and its written loss-coverage pledge are real reasons its promise carries weight. It is simply the arithmetic of a one-way door: money going in while money cannot come out deserves a second thought until the door opens both ways.

Pakistani users face exactly the same suspension as everyone else on Binance.com, and the same scam warning applies with extra force here, because this story has been among Pakistan's most searched topics since Thursday night. Our first report on the suspected hack warned that scammers move fast after exchange incidents, and the warning stands unchanged: rely only on Binance's official channels, ignore unofficial links, messages and requests for account information, and never send a password, a seed phrase or a payment to anyone promising to unlock frozen funds. Nobody legitimate — not Binance support, not a recovery agent, not a Telegram or WhatsApp group promising early access to withdrawals — will ask for those things. Anyone who does is running a second scam built on top of the first theft. The same caution applies to the 48-hour timeline itself: if a message claims withdrawals have reopened early, or offers a link to jump the queue, check it against Binance's own X account and its official status page before clicking anything. A genuine reopening will be announced by Binance, network by network, in public — it will not arrive as a private message.

Three signals will tell readers whether the 48-hour window is being met, and all three are worth watching rather than assuming. The first is a confirmation from the main Binance account that a staged reopening has actually begun — the 04:36 UTC post confirmed the timeline, but confirmation of a timeline is not the same as confirmation of a reopening, and the two should not be confused. The second is the shape of that reopening: which networks and assets come back first, whether limits apply, and how long queues last for ordinary users rather than for the largest accounts. The third is the updated Proof of Reserves Binance says it will publish after remediation, which will let users check its holdings for themselves rather than taking its word for them. Alongside those three sits the still-awaited detailed technical post-mortem, which will show whether the compromised-laptop account survives scrutiny, whether the EIP-7702 delegation element is confirmed or set aside, and what exactly was rebuilt during the 48 hours. Until those documents and the first reopened withdrawals appear, the verified summary is this: Binance expects to begin resuming withdrawals within 48 hours of Yi He's Friday-morning post, deposits are described as operating normally, about $3 billion of a roughly $6.3 billion breach is frozen, all losses are promised covered, and the attacker remains officially unnamed. TaazaPulse will update this story the moment Binance announces that withdrawals have actually begun to reopen, or publishes its post-mortem — whichever comes first.