Binance switched customer withdrawals back on Sunday, four days after attackers siphoned roughly $6.3 billion from its hot wallets in what stands as the largest cryptocurrency theft on record, with the recovery effort now entering its second week. The exchange restored access in stages over the weekend, beginning with bitcoin and then extending coverage to 15 networks.

The gradual restart served as the first major test of whether the platform could absorb a loss of that magnitude without leaving customers locked out for an extended stretch of time.

The recovery operation opened on Saturday. In its third recovery update, Binance said it had replenished 90% of the impacted amount with company funds, tapping part of its Secure Asset Fund for Users, a slice of its futures insurance fund and its corporate treasury to purchase replacement tokens. The Secure Asset Fund for Users is the exchange's emergency reserve earmarked for protecting customer assets.

The futures fund contribution attracted particular scrutiny, as Binance characterized the remaining balance as a regulatory requirement. Alongside the replenishment, the exchange published a fresh proof-of-reserves snapshot dated October 31, giving users a baseline against which to check their balances.

Sunday's reopening began at 06:00 UTC with BTC. Support then followed for ETH, BNB Smart Chain, Solana, XRP, Dogecoin, Tron, Polygon, Avalanche, Arbitrum, Base, Optimism, Zcash, TON and Sui.

Between 06:00 and 15:30 UTC, the exchange handled roughly $4.65 billion in outgoing transfers against about $1.01 billion in deposits, a net outflow near $3.64 billion. That amounts to approximately 2.1% of the $171 billion in assets Binance reported in its late-October proof of reserves.

Deposits stayed open throughout the rollout, and the exchange cautioned that temporary delays could occur during the initial surge in volume.

The Sunday update lifted coverage to 95% of the impacted amount. The remaining 5% sits in less liquid tokens outside the top ten assets on the proof-of-reserves list, and sourcing them at the required scale takes additional time. Binance said it is working with industry partners and over-the-counter desks to complete the purchases, and it has pledged to cover the full amount, reiterating that users will not bear the financial impact of the theft.

On Monday, Binance confirmed that the full zero-knowledge proof for the October 31 snapshot is complete. The technology lets users verify reserves without exposing other customers' account data, addressing the privacy limits of earlier attestation-based reserve reports. Customers holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can run the exchange's verifier, which is open source, to confirm that their balances are backed at least 1:1. A step-by-step guide is also available.

The next snapshot, covering more tokens, is planned for November 4, with proof generation expected to take 40 to 50 hours. A further withdrawal phase is scheduled for Tuesday, and the exchange said it would publish details once the rollout is ready.

Hack Investigation and Market Fallout

On the law enforcement side, the FBI has attributed the attack to North Korea, and the U.S. Secret Service is working with Circle to trace and freeze funds. Tether reported about $1.57 billion in USDT frozen, while Circle said it had frozen more than $800 million in USDC in coordination with authorities. The freezes rely on controls built into centrally issued stablecoins, which allow issuers to blacklist specific wallet addresses.

Markets responded sharply to the breach. Bitcoin dropped about 5% to below $77,000 in the hours following the attack, and shares of Coinbase, Robinhood, Strategy and Strive all declined as investors weighed the risk of exchange-level losses across the sector.

Binance has said it found additional points of breach beyond the initial compromise, which it originally attributed to a single engineer's laptop. The exchange has yet to publish a full post-mortem explaining how the attackers prepared and executed the operation, which some estimates suggest required at least 36 hours of groundwork.

The destination of roughly $3.3 billion in stolen funds that were not frozen remains unexplained, and Binance has not detailed what it expects to recover from that pool. Investigators continue to track wallet activity across ten blockchains.

This article first appeared on Bitcoin Magazine and was written by Micah Zimmerman. Official Binance updates: X post, X post.