Binance has warned users about two fraud schemes emerging as the exchange reopens Bitcoin withdrawals after a reported $6.3 billion hack: fake “priority access” offers and fraudulent fund-recovery services. Both schemes target users concerned about their balances and withdrawal timelines.

Fraudsters target users during hack recovery

When a major exchange pauses and later restores withdrawals, uncertainty can create an opening for scammers. Following Binance’s reopening of Bitcoin withdrawals, fraudsters began approaching users with two specific offers. Related coverage is available in Crypto Novembers: FTX, Binance, Trump and Bitcoin's Run.

The first scheme involves “priority access.” Scammers claim they can move a user’s withdrawal to the front of the queue in exchange for a fee or login credentials. The second involves “recovery assistance,” in which criminals impersonate Binance support representatives and offer to retrieve stolen or frozen funds. They may request sensitive information to “verify” the account.

Neither service exists. Binance does not sell withdrawal-queue priority to individual users, nor does it contact customers unexpectedly to offer recovery assistance. According to CryptoSlate, Binance has warned that a second wave of opportunistic theft is targeting users as the recovery process continues.

The timing is significant. Binance froze roughly $3 billion in assets linked to the hack, leaving many users uncertain about their balances and withdrawal schedules. Scammers exploit that uncertainty by presenting themselves as a shortcut to resolving account problems. Binance’s asset freeze was previously reported by CoinLineup, while its reopening of Bitcoin withdrawals was covered here.

Warning signs of impersonation and recovery scams

These schemes generally follow a recognizable pattern. The clearest warning sign is an unsolicited message. Anyone who contacts a user first by email, Telegram, Discord or social media while claiming to represent Binance should be treated with suspicion. Binance does not cold-call or cold-message users to offer assistance.

Users should be especially cautious of requests for an account password, a one-time verification code (OTP), a seed phrase, a private key or a payment to “unlock” an account or accelerate a withdrawal. Legitimate exchange support will not request these items.

Fraudulent communications can appear convincing. Scammers create email addresses, Telegram handles and websites that closely imitate Binance’s branding. An address resembling “[email protected]” is not necessarily an official Binance domain, so users should inspect contact details carefully.

A similar tactic was used in the Solana Seeker seed-phrase scam, in which a fake application used official-looking branding to steal users’ recovery phrases. The method is similar: create urgency, imitate a legitimate service and request credentials.

Steps Binance users can take

Users concerned about their Binance funds or withdrawal access should go directly to the official Binance website or mobile app. They should not use links contained in emails, social-media posts or messages they did not initiate.

Within the Binance app, users can open their account security settings and confirm that two-factor authentication is enabled. They should also review linked devices and active sessions, removing any they do not recognize.

Anyone who has been contacted by someone claiming to be Binance support should stop responding. Users should not send money, share verification codes or click links provided by the sender. They should save screenshots of the conversation and report the attempted fraud through Binance’s official support page, accessed directly through the app or verified website.

The FBI has linked the Binance hack to North Korea. The FBI’s reporting is available in its 2024 Internet Crime Report. With $6.3 billion reportedly at stake, users face significant pressure and uncertainty—conditions scammers seek to exploit.

Binance does not provide “priority access” or fund-recovery services through unsolicited contact. Users should independently verify any account-related message by logging into the official app or website rather than clicking a link in the message. Binance support is available through the in-app help center and the verified Binance website; an unsolicited message claiming to be from Binance should be treated as fraudulent.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always conduct your own research before making decisions.