Binance Reopens HYPE and APT Withdrawals as Services Recover After $6.3 Billion Hack

Key Facts

Binance announced on November 8 that withdrawals of HYPE and APT were available again, adding the tokens to the list of assets for which withdrawals had resumed after its hot wallets were breached in late October. The exchange said in an official post that "withdrawals have now been re-enabled" for the two tokens. The move marks a further expansion of service recovery, after withdrawals were temporarily suspended for security reviews, remediation of affected systems and checks of their integrity. Binance said deposits and other unaffected services continued to operate during those procedures. The November 8 announcement did not specify a separate audit period before withdrawals of HYPE and APT became available.

The announcement came as part of a phased reopening of withdrawals that Binance began announcing on November 6. The company said the listed assets would become available from 04:00 UTC that day, with not all assets reopening at the same time. The exchange said the order of availability would depend on completion of security and readiness checks for each asset. It also said it was prioritizing tokens based on user demand during the previous week, and that additional assets would be added as they became ready. Withdrawals on the Ethereum network were already available for a group of assets, including RLUSD, USD1, TUSD, FDUSD and XUSD, as well as ENA, USDE, PENDLE, WLD and LINK.

The security measures followed a breach on October 29 at about 20:05 UTC, when the hot wallets were compromised, according to a Binance update. The company estimated the value of the stolen token assets at about $6.3 billion. Binance said the attacker exploited unauthorized access to an internal wallet signing service and executed transactions outside the usual withdrawal process. In a preliminary report, the exchange said the attacker sent 50 signing transactions to manipulate the account's nonce value and create malicious on-chain authorizations. The company said it had found no evidence that private keys were leaked, and its initial update said a compromised DevOps engineer's computer likely enabled access to a service container.

In an update issued on October 30, Binance said it had allocated more than $6.34 billion in company funds, including $5 billion in affected token assets, and estimated that this covered about 80% of the affected value. It added that it was buying the remaining assets through market and over-the-counter channels. It also said about $3 billion in affected assets had been frozen on-chain as of that update. On November 3, the company said 98% of the affected token assets had been replenished as of October 31, adding that the figure could be verified through its proof-of-reserves page. These figures are part of the company's disclosures on addressing the impact of the breach, while the reopening of withdrawals remained tied to readiness checks for each asset.

CryptoQuant data in a report covering November 1 and 2 showed net outflows from Binance of 25,793 BTC and 273,094 ETH. The data also recorded outflows of $3.75 billion in USDT on the Ethereum network and $1.33 billion in USDC over the same period. CryptoQuant estimated these flows were equivalent to 3.6% of BTC reserves on October 28, 7.8% of ETH reserves, 10.3% of USDT on Ethereum and 29.9% of USDC. The company said the outflow recorded on November 1 was the largest in a single day in the preceding year for each asset covered by the report. These figures relate to the start of November and do not measure the impact of the November 8 announcement reopening HYPE and APT withdrawals.

Before the phased reopening began, Binance announced on October 30 that it aimed to resume withdrawal services within about 34 hours, Reuters reported on November 2, alongside a comprehensive security review. The company then said in its November 6 update that the return would take place in stages, depending on the results of security and readiness checks. Binance said systems within the attack path had been rebuilt or replaced, and that it had tightened hardware controls and wallet-service risk controls and expanded monitoring for behavioral anomalies using artificial intelligence. It also said it had rebuilt the affected wallet system in a new environment and rebuilt its internal AI tool and associated access controls. The company said it was working with independent cybersecurity firms to review the incident and identify additional measures.