Binance says withdrawals on track for Sunday, reserves report by Monday

Binance co-CEO Richard Teng says customers should be able to withdraw again before Sunday and that a Proof of Reserves check is "targeting Monday," according to a transcript of his video update that he posted on X at 10:33 a.m. ET on Oct. 30 [1][5]. In it, Teng told users to "[w]ait for our initial Proof of Reserve for public verification, which is targeting Monday" [1]. A Proof of Reserves report is an exchange's public accounting showing it holds enough assets to cover what customers have on deposit.

On withdrawals, Teng said: "We are very hopeful that users will be able to withdraw prior to our Sunday deadline, which is on track to be within 40 hours" [1]. The "40 hours" and "Sunday" are Binance's words; Binance gave no exact reopening time. The update follows the attack on a Binance hot wallet first disclosed on the evening of Oct. 29, covered in Le Coin's breach story and its follow-up on recovered assets.

The mechanism

Teng described how the attacker got in: "The attacker used a known multi-signature protocol EIP-7702, to obtain on-chain execution approval over a hot wallet. That delegation did not pass through our normal approval controls" [1]. A hot wallet is an exchange wallet kept online so it can process withdrawals quickly.

"Multi-signature protocol" is Binance's description. The standard's own published text describes EIP-7702 differently: it lets an ordinary Ethereum account point to a separate piece of code and run that code as if it were its own, a step the specification calls a "delegation" [7]. The specification warns that "a poorly implemented delegate can allow a malicious actor to take near complete control over a signer's" account [7].

Teng said the company paused withdrawals "to investigate, rebuild, and retest the entire infrastructure system," and that "we are rebuilding the withdrawal service, and we are not switching it back on until it passes rigorous testing" [1]. Binance's first theory has shifted: "Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach" [1].

The evidence

The update restates Binance's money commitments but adds no new loss or frozen figure (Figure 1). "Binance has reserved over $6.34B of company funds to cover the stolen assets. $5B of these funds are already held in the exact token assets that were impacted, such as USDC, USDT, BTC, ETH, BNB etc.," Teng said [1]. Those are the same figures Binance posted at 6:55 a.m. ET [3]. The $6.34 billion is a reserve set aside by the company, not a measure of the loss. Binance's own loss figure remains its "estimated total impact" of about $6.3 billion, from its Oct. 29 post at 10:25 p.m. ET [2]. Teng did not restate that number or the roughly $3 billion Binance has called frozen [3].

For the rest, Teng said, "We are working on the outstanding amount by buying the token assets through market and OTC channels" [1]. OTC, or over-the-counter, trades are large deals arranged directly between two parties rather than on an exchange's public order book.

On customers, Teng was categorical: "We NEVER use any customer funds, so they are not impacted. What was affected in this incident was Binance's own hot wallet" [1].

The wording has changed. At 4:47 a.m. ET, Binance said withdrawals would resume "in 45 hours" [4]. Teng's update says "within 40 hours" and ties it to a "Sunday deadline" [1] (Figure 2). Binance's Oct. 29 post had promised an "updated" Proof of Reserves with no date [2]; the update adds Monday.

Teng said Binance is "working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds" [1]. That is Binance's claim; no law-enforcement agency has confirmed it. The update names no attacker. Teng's update does not mention blockchain analytics firm Chainalysis's attribution of the attack to North Korea's TraderTraitor group [8].

The objection

The dates are targets, not commitments. Teng said he is "very hopeful" on withdrawals, and the service stays off "until it passes rigorous testing" [1]. A failed test could push the reopening past Sunday, and Binance has already restated its window once, from "in 45 hours" to "within 40 hours," each counted from a different post.

The reserves report also comes in more than one form. Besides the "targeting Monday" line, the same transcript says, "We will be sharing a full Proof Of Reserves report by Monday, and we are hoping to give an initial view of Proof of Reserves before that" [1]. Which document arrives Monday, and what it covers, is not yet clear. And the $5 billion in matching tokens and the $6.34 billion reserve are Binance's own statements; no outside party has verified them, and Binance's announcement page on its website could not be checked because it blocked automated access.

The tell (Le Coin's view)

The withdrawal reopening is the test that matters. A Proof of Reserves report shows balances at a moment in time; customers moving money out on schedule shows the exchange can actually pay. If withdrawals reopen before Sunday and the Monday report lines up with the $6.34 billion reserve claim, Binance's account of a contained, company-funded loss gets much harder to doubt. If the window slips again, or the Monday document turns out to be only an "initial view," expect pressure for an independent audit.

Stop

Binance says withdrawals should resume before a Sunday deadline and that a Proof of Reserves report is targeting Monday. It gave no new loss or frozen figure, and its $6.34 billion reserve claim has not been independently verified.

Sources

1. Richard Teng (@_RichardTeng), transcript of video update, Oct. 30, 10:33 a.m. ET, post 2116176703823528024: https://x.com/_RichardTeng/status/2116176703823528024
2. @binance, Oct. 29, 10:24 p.m. ET (edited 10:25 p.m.), post 2115993361517891592: https://x.com/binance/status/2115993361517891592
3. @binance, Oct. 30, 6:55 a.m. ET, post 2116121748555153621: https://x.com/binance/status/2116121748555153621
4. @binance, Oct. 30, 4:47 a.m. ET, post 2116089661408108712: https://x.com/binance/status/2116089661408108712
5. Richard Teng, video "An update on the security incident," Oct. 30, 10:32 a.m. ET, post 2116176335722913865: https://x.com/_RichardTeng/status/2116176335722913865
6. @binance quote-post of Teng's video, Oct. 30, 10:34 a.m. ET, post 2116176954433102033: https://x.com/binance/status/2116176954433102033
7. "EIP-7702: Set Code for EOAs," Ethereum Improvement Proposals: https://eips.ethereum.org/EIPS/eip-7702
8. Chainalysis, "The $6.4 Billion Binance Exploit: Tracing the North Korea Link," Oct. 30, 5:34 a.m. ET: https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/

Holding the Corner.

Not financial advice.