Binance Expects to Begin Resuming Withdrawals Within 48 Hours

Published October 30, 2026, 10:20 AM PKT. This is a follow-up to MABOnChain's October 30 articles on Binance's investigation into a suspected multi-billion wallet drain, its pause of withdrawals, its pledge to cover all losses and suspend all deposits and withdrawals, its first findings pointing to a compromised DevOps engineer's laptop, and TRM Labs' attribution of the hack to North Korea. It is based on Binance co-chief executive Yi He's service update posted on X on October 30, 2026 (primary source for the 48-hour timeline and the deposits position, as reported by TokenPost, FinanceFeeds and The Defiant), and on CoinDesk, AjuPress and TradingView reporting (secondary sources). Where sources disagree, this article says so rather than picking a winner.

Binance customers have a first date to watch. Co-chief executive Yi He said in a service update posted on X at 04:17 UTC on October 30 that Binance expects to begin resuming withdrawal services within the next 48 hours, while deposits remain unaffected and continue to operate normally. The update is the first reopening timeline Binance has given since it halted withdrawals at 22:15 UTC on October 29, after the hack it estimates had a $6.3 billion impact. TokenPost, which published the update at 04:20 UTC, stresses that the estimate covers the beginning of the return, not a stated deadline for full service, and that Yi He gave no specific hour for the start of restoration beyond the 48-hour window and no schedule for which withdrawals return first. FinanceFeeds calculates that the window runs to about 04:17 UTC on November 1, which would mean customers locked out of withdrawals for up to about 54 hours in total from the October 29 pause. That arithmetic is FinanceFeeds', not Binance's, and Binance has not confirmed a staged reopening by network or asset, lower limits at first, or any other shape for the restart. The practical meaning of the update is therefore narrow but real: withdrawals are not reopening today on any confirmed schedule, but Binance now says the restart should begin within two days, and deposits, on Yi He's account, are already operating normally.

The 48-hour timeline, and the deposits contradiction

Yi He's update says the team is working on enhancements to the withdrawal service and related address controls, which lines up with Binance's own account of the breach. Its initial investigation found that a compromised DevOps engineer's laptop gave an attacker access to a service container that could submit unauthorized withdrawal transactions, and Binance said it had already revoked the affected address authorisation. A 48-hour target for rebuilding withdrawal controls, rather than simply flipping a switch, suggests the work is a rebuild of those controls, FinanceFeeds notes, and The Defiant reports the same framing: Yi He says deposits are operating normally as the exchange pledges to cover losses from an incident it estimates had a $6.3 billion impact. But the deposits claim conflicts with Binance's own earlier statements, and readers should see the conflict plainly. At 00:13 UTC on October 30, Binance said all deposits and withdrawals are temporarily suspended. Its 02:25 UTC investigation update again listed temporarily suspended deposits and withdrawals among its precautions. Yi He now says deposits remain unaffected and continue to operate as normal. FinanceFeeds flags the contradiction directly, and this article does not resolve it: either deposits were restored between the 02:25 UTC update and Yi He's 04:17 UTC post without a separate announcement, or the earlier suspension wording overstated the deposits position. What is confirmed is only what Yi He said at 04:17 UTC, that deposits are operating normally and that withdrawals should begin resuming within 48 hours. Yi He had earlier linked the resumption of withdrawals to the completion of a security scan, saying withdrawals would be enabled as soon as the scan is complete, and the 48-hour window is the first time Binance has put a clock on that work.

The institutional rush to pull funds from exchanges

The timeline lands as the hack's fallout spreads beyond Binance itself. CoinDesk reported on October 30 that institutional investors are rushing to withdraw crypto from centralized exchanges after the Binance hack, according to people familiar with the matter who spoke on condition of anonymity because the matter is private. The investors are looking to rebalance trading books following the hack, the people said, and the withdrawals suggest the fallout is extending beyond the world's largest crypto exchange, putting the security of assets held on trading platforms back in focus. CoinDesk is explicit about what it does not know: the amount institutional investors are withdrawing across exchanges, and the destinations of those funds, were not immediately clear, and CoinDesk said it had reached out to Binance for comment. That is a thin evidentiary base for a market-wide claim, and this article reports it as anonymous-source reporting, not as confirmed outflow data. What is confirmed around it is the context that makes the rush plausible: Binance estimated that about $6.3 billion in assets were stolen in the attack, with roughly $3 billion subsequently frozen, the exchange suspended withdrawals, and Yi He said it would cover all losses. CoinDesk also notes the structural exposure: centralized exchanges hold customer assets and facilitate trading, making them important infrastructure for institutional investors, so a security failure at the largest venue puts both asset safety and access at risk at once. Even before the Binance breach, security firm CertiK recorded $1.28 billion in losses in the third quarter of 2026, up nearly 56 percent from the previous quarter, CoinDesk reports, so the Binance incident hits an industry already running hot on exploit losses. Markets reflected the fear: Bitcoin fell below $77,000 and ether fell to $2,237.54 as news of the breach spread, according to CoinDesk, and TradingView reported about $627.7 million in derivatives liquidations in the hour when hacking concerns spread, $606.6 million of it on long positions.

Contagion beyond Binance: DeFi freezes and Korean exchange alerts

Two named, checkable developments support the picture of widening caution. In decentralized finance, Aave blocked new deposits and borrowing in its Ethereum mainnet V3 market, while Kamino temporarily halted borrowing in its SOL and BTC markets as a precaution, TradingView reports, citing Odysseas Lampridis, founder of Phylax Systems, who said the fallout is spreading into DeFi because stolen assets entering lending collateral pools could expose protocols outside centralized exchanges to risk. In South Korea, domestic exchanges issued withdrawal alerts on October 30, AjuPress reports: Upbit issued a warning regarding Binance's security incident and urged users to exercise caution with withdrawals, saying it would limit withdrawals to Binance if necessary and respond to requests for asset freezes, and Bithumb, Coinone and DigitalX also posted withdrawal alerts. AjuPress adds a new detail on the cause, reporting that the incident is believed to have started when a laptop belonging to a Binance DevOps engineer was hacked, and that Binance said there is currently no evidence that the private keys of cryptocurrency wallets have been compromised, which matches Binance's own published findings. AjuPress also reports that Binance plans to fully compensate users for losses using its Secure Asset Fund for Users, known as SAFU, and its own funds. None of these steps is a confirmed loss at those venues: they are precautionary freezes and warnings, and they should be read that way, not as evidence that other exchanges were breached.

What has not changed

For Binance's own customers, the confirmed position is unchanged in every respect except the new timeline. Binance estimates the impact at around $6.3 billion, TRM Labs independently traced about $6.36 billion moved across ten blockchains in about 20 minutes on October 29, and about $3 billion has been frozen on-chain, including more than $2.37 billion in USDT and USDC frozen by Tether and Circle. Binance pledges to cover all losses from its SAFU fund and company funds, and founder Changpeng Zhao has said he expects all user funds to be fully covered, but Binance has not said which source will pay, how much of the unfrozen remainder each source covers, or when an updated proof-of-reserves disclosure will appear. TRM Labs attributes the attack to North Korea's TraderTraitor unit with high confidence, but Binance has not itself confirmed that attribution, and no law enforcement statement confirming it appears in this article's sources. Binance has promised a full post-mortem once the investigation is complete, and that post-mortem must still reconcile the laptop account with TRM's assessment that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains. Until withdrawals actually begin resuming, customers should treat any message offering to unlock withdrawals for a fee, or asking for account details through an unofficial link, as a scam, and rely only on Binance's official channels.

What to watch next

The next verified facts to look for are a confirmation from Binance's main account that withdrawals have begun resuming, and whether the restart is staged by network or asset; a clarification of the deposits position, given the contradiction between the 00:13 UTC and 02:25 UTC suspension statements and Yi He's 04:17 UTC statement that deposits operate normally; Binance's detailed technical post-mortem; its updated proof-of-reserves figures; any statement from law enforcement confirming or disputing the TraderTraitor attribution; and confirmed outflow data, if any, behind the reported institutional rush to withdraw from other exchanges. Until then, the confirmed position is this: Binance expects to begin resuming withdrawals within 48 hours of Yi He's October 30 service update, deposits are operating normally on Yi He's account, about $6.3 billion was impacted with about $3 billion frozen, Binance pledges to cover all losses, and institutional investors are reported, on anonymous sources, to be pulling funds from centralized exchanges while DeFi venues and South Korean exchanges take precautionary steps.

This article is news reporting and is not investment advice.

Sources

• Binance co-chief executive Yi He, service update on X, October 30, 2026, 04:17 UTC (as reported by TokenPost, FinanceFeeds and The Defiant), primary source for the expectation to begin resuming withdrawals within 48 hours, deposits remaining unaffected and operating normally, and work on enhancements to the withdrawal service and related address controls
• TokenPost, Binance Sets 48-Hour Window to Begin Reopening Withdrawals (published October 30, 2026, 04:20 UTC), primary reporting of Yi He's post, noting the estimate covers the beginning of the return, not full service, with no specific hour or completion date
• FinanceFeeds, Binance Withdrawals Expected Back Within 48 Hours (published October 30, 2026), secondary source for the 04:17 UTC post time, the window running to about 04:17 UTC on November 1, the conflict with the 00:13 UTC and 02:25 UTC suspension statements, and the earlier withdrawal pause at 22:15 UTC
• The Defiant, Binance Expects to Start Resuming Withdrawals Within 48 Hours (published October 30, 2026, 04:29 UTC), secondary source for Yi He's deposits position and the $6.3 billion impact estimate with roughly $3 billion frozen
• CoinDesk, Binance hack sparks rush by institutional investors to pull crypto from exchanges (published October 30, 2026, 03:56 UTC, updated 04:15 UTC), secondary source for the institutional withdrawal rush on anonymous sources, the rebalancing motive, the unknown amounts and destinations, the $6.3 billion stolen and roughly $3 billion frozen figures, the CertiK third-quarter $1.28 billion loss figure, and the Bitcoin below $77,000 and ether $2,237.54 prices
• AjuPress, Binance Hacked for $6.3 Billion, Domestic Exchanges Issue Withdrawal Alerts (published October 30, 2026), secondary source for Upbit, Bithumb, Coinone and DigitalX withdrawal alerts, the DevOps laptop account, the no private key compromise statement, and the SAFU plus company funds compensation plan
• TradingView News, Binance Hit by Suspected $5.7 Billion Outflow, Roiling Crypto Market (published October 30, 2026), secondary source for the Aave Ethereum V3 deposit and borrowing block, the Kamino SOL and BTC borrowing halt, the Phylax Systems contagion assessment, and the $627.7 million one-hour liquidation figure
• MABOnChain, TRM Labs Blames North Korea for $6.36B Binance Hack (October 30, 2026), context for the TRM attribution, the $6.36 billion traced total, the $2.7 billion frozen, and the $2.4 billion beyond issuers' reach
• MABOnChain, Binance Points to Compromised DevOps Laptop in $6.3B Hack, No Key Leak Found (October 30, 2026), context for Binance's laptop findings, its $6.3 billion estimate, its coverage pledge, and the previously open reopening question