Binance Puts Up $6.34 Billion: The Backstop, the Frozen $3 Billion, and the Sunday Withdrawal Test

Yesterday we reported the theft itself: an estimated $6.3 billion drained from Binance, bitcoin to $76,400, and $1.57 billion of futures liquidations. The question since then has been who pays, and when customers get their money moving again. On Friday, Binance answered with a number: more than $6.34 billion set aside from its own funds, through its Secure Asset Fund for Users and corporate treasury, so users do not bear the loss. That is a pledge, not yet a completed payment — and the next 48 hours contain the two tests that decide whether it holds. General information only — not financial advice.

What the $6.34 billion actually consists of

Binance says about $5 billion is already held in the exact cryptocurrencies taken — USDC, USDT, bitcoin, ether, and BNB — roughly 80% of the impacted amount. The remaining roughly $1.3 billion is being bought on public markets and over the counter, and Binance has warned thin liquidity and settlement delays could slow that part. The $6.34 billion is therefore a commitment backed mostly by assets already in hand, with about a fifth still to acquire. It is not cash in a single account, and it is not the stolen funds recovered.

The frozen figure needs the same care. Binance puts it at around $3 billion, frozen with help from law enforcement, intelligence firms, issuers, and partners. Elliptic's independent analysis verified $2.84 billion frozen as of 8 a.m. UTC on October 30, predominantly USDT and USDC. Frozen means the attacker cannot spend those funds. It does not mean they have been returned to Binance or customers.

How the breach is described so far

Binance placed the start of the hot-wallet compromise at approximately 20:05 UTC on October 29. Its initial investigation pointed to a compromised DevOps engineer's laptop as a possible entry point, with additional breach points found since and no evidence so far of leaked wallet private keys. TRM Labs described an EIP-7702 delegation that caused a Binance Ethereum hot wallet to execute attacker-controlled code, and TRM Labs and Chainalysis have linked the theft to the North Korea-linked group TraderTraitor, as reported by Reuters and others. Binance has not confirmed who was responsible; its investigation continues. Treat the attribution as the analytics firms' finding, not Binance's conclusion, and not independently verified here.

The market did not wait for the backstop

Bitcoin traded near $77,177 at 06:05 UTC on Saturday, per CoinGecko data cited by Crypto Times — down 0.9% in 24 hours and 4.3% over seven days, range $76,338 to $78,638, market capitalisation about $1.55 trillion. The low sits just under October 30's $76,400. About $427 million of leveraged positions liquidated in 24 hours, 73% longs, affecting roughly 93,000 traders; Binance processed about half, including an $11.43 million BTC/USDT order. U.S. spot bitcoin ETFs posted $643.33 million of net outflows on Friday, led by BlackRock ($233.7 million) and Fidelity ($201.04 million). Ether was around $2,239, Solana $95.88, BNB $702.46, and XRP $1.25 in the SpendNode snapshot, with Fear and Greed at 35, in “fear” territory.

Cointelegraph reported the crypto market lost roughly $300 billion in value during October, against the seasonal expectation behind “Uptober.” October 31 is also the 18th anniversary of Satoshi Nakamoto sending the bitcoin whitepaper to a cryptography mailing list in 2008 — the idea turned 18 in a month when the largest exchange theft on record left the market testing $76,000 two days running.

Three tests, in order

First, withdrawals. Binance targets the start of a phased restart within about 34 hours of its October 30 update, subject to security checks; deposits and unaffected services remain operational. A phased restart is not a full reopening. Whether withdrawals actually move, and for which assets first, is the most direct signal of how contained Binance considers the breach.

Second, proof of reserves, due Monday, November 2, after an initial snapshot within 12 hours of the update. It shows holdings in known wallets against customer balances at a single moment. It is better than nothing, and it is not an audit: it does not by itself show where assets came from, whether anything was borrowed for the day, or what obligations sit outside the list.

Third, the remaining purchases and frozen funds. Buying roughly $1.3 billion through thin markets can move prices itself; growth in the frozen total, toward recovery, would shrink the loss in fact rather than in pledge. And Monday's ETF flows will show whether Friday's $643 million of redemptions was a one-day reaction or a longer exit.

Sources, all checked this morning: the reserve size, $5 billion held, SAFU and treasury funding, compromise time, phased withdrawal target, and proof-of-reserves timetable via crypto.news, “Binance reserves $6.34B, targets phased withdrawal restart” (crypto.news), corroborated by the Indian Economic Observer's report of the same update; prices, liquidations, and ETF flows via Crypto Times, “Bitcoin Price Today: BTC Falls to $77K as $427M in Crypto Liquidations Hit, ETFs See $643M Outflow,” October 31 (cryptotimes.io); Elliptic's $2.84 billion verified freeze and the 48-hour technical-findings timetable via CryptoNews; the October market-value loss, majors snapshot, and Fear and Greed reading via SpendNode's summary of Cointelegraph and CoinMarketCap data; the prior day's theft, prices, and liquidations from our own coverage, yesterday's story, based on CoinDesk's October 30 Markets Today report. Our paper-trading diary publishes separately each evening and is not part of this market report.