Binance is promising to absorb a roughly $6.3 billion hack, but customers are still waiting for the withdrawal button to work again.

The attack struck on October 29, and the exchange's October 30 updates describe an investigation that has expanded beyond an initially suspected compromised laptop. Binance says it has reserved more than $6.34 billion of company funds to cover the stolen assets. About $5 billion is already held in the affected tokens, with purchases of the remainder underway. In his latest video transcript, co-CEO Richard Teng said the rebuilt withdrawal service would reopen only after rigorous testing. He said the Sunday deadline remained on track, while expressing hope that users could withdraw sooner.

That is a target, not a reopening announcement. Binance's latest written service notices say deposits are operating normally while withdrawals remain paused. Teng also committed to a full Proof of Reserves report by Monday, November 2, with an initial view hoped for earlier. The Sunday he referred to is November 1. Those dates give customers concrete milestones against which to judge the company's assurances, rather than another open-ended promise that everything is fine. A visible account balance and an operational withdrawal service remain different things.

Billions reserved, billions frozen - different things

The money Binance says it has reserved is separate from approximately $3 billion in assets it says partners have frozen. Its earlier funding update explicitly excluded frozen or protected assets from the $6.34 billion commitment. Those assets still require recovery and verification. Binance says it is buying the missing token quantities through markets and over-the-counter trades, and warns that limited liquidity and settlement times can slow that work. Setting aside a dollar amount therefore does not mean every replacement token has already arrived. The company has pledged to cover the losses, but its promised reserve disclosure is still ahead.

Independent Elliptic analysis, updated at 13:10 UTC on October 30, estimated the theft at $6.43 billion and verified $2.84 billion frozen onchain. That is its own snapshot, rather than Binance's final accounting. Elliptic calls this the largest crypto theft on record, far exceeding the roughly $1.46 billion Bybit theft last year. Most of the frozen value is in stablecoins whose issuers can restrict transfers. Bitcoin and native ether have no issuer with that same freeze switch, leaving investigators dependent on tracing and intervention when funds reach services. Freezing a token also does not by itself put it back in Binance's wallet.

More than a laptop, and an attribution still under scrutiny

The technical explanation is still developing. Binance first described a possibly compromised DevOps engineer's laptop and said it had found no evidence of wallet private-key leakage. It subsequently disclosed additional breach points, without laying out the complete attack path. TRM Labs' investigation says the Ethereum portion involved EIP-7702, a feature that lets a wallet delegate execution to smart-contract code. The attacker used signed authorizations to install malicious behavior on a hot wallet, while wallets on other chains sent ordinary signed transfers. TRM interprets that wider pattern as evidence of compromised signing infrastructure. Teng's newer account says the delegation bypassed normal approval controls and that attackers destroyed tooling and traces; those remain the company's findings pending a full technical report.

TRM attributes the attack to North Korea's TraderTraitor group with high confidence, while Elliptic considers North Korean involvement likely. Elliptic also cautions that a shared laundering address does not prove the same hackers carried out separate thefts. Its report says no government or law-enforcement agency has confirmed attribution. For customers, the immediate questions are whether withdrawals actually reopen, whether the promised reserves match affected assets, and what the final investigation establishes about the failed controls. Teng says the review now covers devices, cloud infrastructure, key management and signing systems across the company. The next meaningful update is evidence that those repairs and replacement purchases are complete, not simply another repetition of the compensation pledge.