A 6.3 billion dollar theft does not close with a press release, but with a sequence of withdrawal windows, proof-of-reserves statements and denials. Six days after the attack on Binance’s hot wallets the story runs on three tracks: the technical restoration, the accounting cover, the battle over attribution.

The phased reopening

The first phase began on 1 November, with the Bitcoin network first and then Ethereum and BNB Smart Chain. On Monday Binance also reopened fiat withdrawals, the dollar included, alongside dirham, dong, Philippine peso and Indonesian rupiah.

The second phase is set from 04:00 UTC on Tuesday, with progressive reopening on Binance Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base. The exchange says it ordered the assets by demand over the past weeks. Deposits remain active. Net outflows, according to DefiLlama, fell to 2.57 billion on Monday, against 6.1 billion on Sunday: the peak of the run on the bank seems to have passed. Binance also warned that anyone promising accelerated withdrawals for a fee is running a scam.

Who pays the bill

Cover is the accounting part. On Saturday the company spoke of 90% of assets reimbursed; on Monday, with the new proof of reserves, the stated figure rose to 95%. Binance drew on the Secure Asset Fund for Users, on a portion of the futures insurance fund and on the corporate treasury, specifying that the ten main tokens are 100% covered and that the remainder is made of less liquid assets.

It is worth keeping apart two numbers that are often confused: covering users is not recovering funds. The 6.3 billion stay in the attackers’ hands, who according to the FBI are converting them into Ethereum ahead of the later stages of laundering.

Pyongyang’s denial

On Tuesday Kim Yo-jong, sister of the North Korean leader and a government official, rejected the US attribution, calling it “a grave political provocation”. The statement, distributed by KCNA and reported by Yonhap, accuses the FBI of wanting to label the country a “criminal cyber state” and of pinning every cybercrime on the planet on it.

The FBI had attributed the theft on Saturday, naming the TraderTraitor group; before that came analyses by TRM Labs and Chainalysis. The technical reconstructions describe a prepared attack: malicious code tested on three wallets, EIP-7702 used to turn a hot wallet into a sweeper controlled by the attackers, around fifty pre-signed authorisations so that at least one would stay valid. On-chain evidence and political claim speak different languages, and neither persuades the other.

The second exchange

Meanwhile the bill grows. Mercado Bitcoin, Brazil’s largest exchange, confirmed a breach worth around 46.3 million dollars according to Arkham, suspending deposits and withdrawals. The company maintains that customers and data were not touched; for CertiK the attackers worked four hours across eight minor chains, then moved tiny amounts of ETH from over 27,000 addresses. Tether and Circle froze around 6.2 million in stablecoins.

The picture is not that of an ecosystem under siege, but of a sector in which security has become a balance-sheet line. Bitcoin sits just above 76,000 dollars: the market absorbed the news without panic. The politics of attribution, on the other hand, has only just begun.

Verified sources: Cointelegraph, “Binance begins second withdrawal phase, exchange outflows slow”, 2 November 2026 (read on 3 November); CNBC, “Binance resumes withdrawals following record $6.3 billion hack”, 31 October 2026; The Block on proof of reserves and 95% cover, 2 November 2026; Yonhap (2 and 3 November 2026), Korea Herald and Business Insider on Kim Yo-jong’s statement; The Block and Cointelegraph on Mercado Bitcoin, 2 November 2026; CoinGecko (76,533 dollars, -2.14% in 24 hours) and Cointelegraph (76,905 dollars) for the BTC quote. Excluded for insufficient sourcing: the three SEC staff FAQs (SEC page unreachable, secondary source only), Vitalik Buterin’s post on elliptic curves (opinion, single source) and the Polymarket figure on probabilities above 80,000 dollars.