Binance Reopens Withdrawals and Publishes Reserve Proof

gm, Defiers!

These are the biggest stories in DeFi and crypto:

• Binance reopened withdrawals after its hack
• Binance's attackers routed USDT claims past freezes
• A Linux bug sent validators and tBTC offline
• BTCPay Server told operators to shut down
• Morpho borrow rates hit about 40% after the hack

Binance reopened withdrawals over the weekend, starting with bitcoin on Sunday. By 7:36 a.m. ET that day, all 15 network groups in its first phase were open, and U.S. dollar withdrawals came back today. In the first nine and a half hours, customers withdrew $4.649 billion and deposited $1.01 billion, Binance said. It now says it has replaced about 95% of the stolen assets with its own funds. The rest are less-liquid tokens it is still buying.

So far, Binance has covered the loss with its own money, without counting the frozen funds. On Friday, we wrote that Binance's $6.34 billion reserve covered the estimated $6.3 billion loss before any frozen funds came back. Only $5 billion of it was held in the stolen tokens, about 80% of the loss. Binance closed most of that gap in three days. It reported 90% replaced on Saturday and 95% on Sunday. To get there, it drew on its corporate treasury and part of its futures insurance fund. Binance says what remains in that fund still exceeds the coverage its risk framework requires. It also moved 7,499 BTC, worth about $581 million, out of its SAFU emergency fund. By our arithmetic, that transfer alone covers about 9% of the loss. The roughly $3 billion that partners froze is still outside the count.

The proof is arriving in pieces: today, Binance said it had completed a zero-knowledge proof of reserves for 10 assets: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Users who hold those assets can check that their balances are counted and backed one to one. An earlier version on Binance's reserves page used a snapshot from 8 p.m. ET on Oct. 30. Binance plans another snapshot on Wednesday. Co-founder Yi He said each proof takes about 40 to 50 hours to compute after the snapshot.

Binance says more networks and assets will reopen in stages from Tuesday.

Read more below!

As of 21:00 UTC, Nov. 2. Data: CoinGecko, Aave, Hyperliquid. Full list

HACKS

Binance Begins Reopening Withdrawals With Bitcoin After $6.3 Billion Hack

Binance reopened withdrawals in stages, choosing routes by the previous week's customer demand, and kept deposits open. Withdrawals for LINK, WBTC, WBETH, USDS and HYPE remain suspended, and some BTC, ETH, USDT and USDC routes are still partly closed. Customers kept pulling funds into Monday. The FBI attributed the theft of more than $6 billion to North Korea's TraderTraitor group, and North Korea rejected the blame. The FBI asked exchanges, bridges and node operators to block transactions tied to the attackers, so any service that processes the funds now does so against a federal request.

Binance Begins Reopening Withdrawals With Bitcoin After $6.3 Billion Hack

thedefiant.io

HACKS

Chainalysis Flags DeFi Receipt-Token Route in Binance Hack

Chainalysis said the attackers move claims on USDT through Tron lending protocols before bridging into ETH. AMLBot named the platform as JustLend and the receipt token as jUSDT, a claim the issuer's blacklist does not reach. After moving more than $500 million on Tron, the launderers reached Solana. SomaXBT traced $140 million out of Tron through four bridges. Relay said its blocking is delaying some routes, and THORChain's co-founder answered the FBI without committing to screening. The attacker also split $292 million in XRP, and Elliptic flagged the first bitcoin mixing.

SECURITY

Anza Urges Solana Validators to Act on Critical Linux Flaw

Anza told Solana validators to act now on CVE-2026-98432, a Linux kernel bug rated 9.8 out of 10. Anthropic said its research model built an exploit that gives a remote attacker root access on servers with a Multipath TCP listener. Intersect gave Cardano pool operators the same advice. Threshold paused tBTC minting and redemptions, and its operators have patched or gone offline. It says 4,320 BTC still back about 4,185 tBTC. Aave froze its tBTC reserve, which held about $136.5 million.

HACKS

BTCPay Server Urges Shutdown After Reports of Hot-Wallet Sweeps

BTCPay Server told operators to shut down on Sunday after reports of hot-wallet drains, then tied the attack to version 2.4.1 and older. Brazil's Mercado Bitcoin suspended deposits and withdrawals after an incident and says customers lost nothing. Arkham says the attacker holds $46 million, Tether froze 4.5 million USDT, and one researcher puts freezes near $7 million. A breach wallet sent 2,800 ETH onward. ZachXBT flagged a suspected $106 million theft from an EU entity's exchange accounts.

DEFI

Morpho Borrow Rates Hit Roughly 40% as PT Market Liquidity Dries Up

Morpho borrowing rates in markets tied to Pendle tokens jumped to roughly 40% after the Binance hack as lenders pulled USDC, then cooled to 8.9% to 12.7% by Saturday, according to OAK Research. That turned some leveraged Pendle trades into losers. Jupiter Lend's USDC vault had 27.9 million USDC available on Saturday, and Tydro restored its 75 million USDC cap. Origin put OGN liquidity back after pulling it to limit the attacker's sales, and Curve's trading volume halved from Thursday's spike.

Other Stories Worth Your Time

CertiK Puts 2026 Crypto Losses at Record $9.2 Billion — Binance's breach drove most of October's $6.5 billion.

b14g Says 97 Million CORE Drained, Pauses Contracts — a Core hard fork recovered 68.15 million. Also: Premia lost $437,000, Origami's vaults stay paused, and a fake SKR app reached Solana Mobile's store.

THORChain Swaps Remain Paused on 12 Chains After Reported Refund Error — only Zcash was still trading.

Ethereum Draft Would Let Wallets Permanently Disable EIP-7702 Delegation — owners could refuse delegated code at their addresses.

OKXICE Stock-Token Objections Reach 50, Including Nvidia — plus the NYSE picked Broadridge for onchain voting.

SEC Staff Clarifies When Token Voters Are Not a 'Central Party' — New Jersey rescinded its Coinbase staking order, and Coinbase opened perps to AI agents.

Tether Reports $1.5 Billion Q3 Operating Profit, $7.95 Billion Reserve Buffer — plus 1kx found app fees out-earned blockchains in Q3.

Standard Chartered Launches 24/7 Tokenized Deposits in Hong Kong — plus SBI plans $100 million for Erebor.

Akash Stakers Approve Move From Cosmos to Solana — also: NEAR cut its issuance cap, BNB Chain tested a payment lane, Jito named outside BAM operators and Injective added a priority rail.

XRP Ledger Token-Permission Fix Heads for Wednesday Activation — and Horizen's bridge closes Nov. 4.

Swell Lifts swETH and rswETH Withdrawal Pauses After Rate Reset — and opened Swellchain claims. Also: Liquid's reserve gap fell to 250 BTC, and Lido's revenue jumped.

Uniswap Extends VolatilePair Hook to Robinhood Chain — plus Pump.fun cut referral payouts.

Trending on The Defiant