Binance warns of second wave of crypto theft as $6.3 billion hack recovery continues

Binance has warned customers about potential scams exploiting withdrawal delays as the exchange recovers from a $6.3 billion security breach.

In a Nov. 2 security advisory, the exchange said fraudsters could take advantage of its phased withdrawal reopening by impersonating Binance representatives and offering customers assistance with delayed transactions, compensation claims and asset recovery.

The warning covers fraudulent emails, direct messages, group chats and even small cryptocurrency transfers carrying malicious instructions.

According to Binance, scammers may promise to speed up pending withdrawals, sell customers priority access to withdrawal queues, or instruct them to transfer their holdings into supposedly secure wallets.

The exchange emphasized that it does not charge fees to unlock withdrawals, offer paid recovery services or ask customers to authorize wallet transactions to regain access to their funds.

It also warned against fraudulent proof-of-reserves websites and compensation eligibility links, which could become particularly deceptive as the exchange introduces new verification tools following the breach.

Once customers approve malicious wallet permissions, attackers can transfer their assets without further authorization, potentially creating losses that cannot be reversed.

The warning comes as Binance attempts to restore normal operations after an Oct. 29 attack that compromised its hot wallets and resulted in approximately $6.3 billion in stolen cryptocurrencies.

Binance verifies major crypto reserves as recovery remains incomplete

Meanwhile, Binance announced on Nov. 2 that it had completed the zero-knowledge proof for its Oct. 31 reserve snapshot, allowing customers to independently verify the backing of ten major cryptocurrencies.

The covered assets include Bitcoin, Ethereum, BNB, XRP, Solana, Zcash, and four stablecoins: USDT, USDC, USD1, and RLUSD.

Binance said the completed proof lets customers verify that their balances were included in the snapshot and backed by reserves of at least 1:1, without revealing individual account holdings.

The process requires users to obtain account-specific verification information and download a verification tool through Binance's official proof-of-reserves platform.

However, the verification applies to balances recorded at 00:00 UTC on Oct. 31 and does not establish the exchange's current financial position or independently audit its overall solvency.

The announcement also comes as Binance continues replenishing assets affected by the theft.

According to the exchange, approximately 95% of the impacted assets have been replaced using company resources, while the remaining 5% consists of less-liquid cryptocurrencies that are more difficult to acquire in sufficient quantities.

Binance has been sourcing those assets through market purchases and over-the-counter transactions, separately from efforts to trace and recover the original stolen funds.

The exchange began restoring withdrawals on Nov. 1, with access returning progressively across supported cryptocurrencies and blockchain networks.

Another phase is scheduled for Nov. 3, although Binance has yet to confirm which additional assets and networks will become available.

The prolonged reopening gives fraudsters an opportunity to exploit customers awaiting access to their funds, particularly through fake support channels and requests for wallet authorizations.

Binance has instructed customers with pending withdrawals to check their status directly through its application and verify suspicious communications using its official verification service.

The exchange plans to publish another reserve snapshot on Nov. 4 covering additional cryptocurrencies. Generating the accompanying zero-knowledge proof is expected to take another 40 to 50 hours.