A half-raised metal shutter lets a line of bitcoin coins slip out while people wait in silhouette in the dark
Original AI-generated illustration.

Binance Reopens Bitcoin Withdrawals From a New Wallet That Paid Out 8,801 BTC in 15 Blocks

NodeWitness Team 8 min read

The hot wallet the attacker drained made no payments when withdrawals reopened. Binance's bitcoin withdrawals are flowing out of a brand-new address instead, one the exchange put on its own reserve list, and in its first 15 blocks of payouts it moved more than the old wallet did on a normal day.

"First batch network now opened in phase one of withdrawals is $BTC bitcoin network," Binance posted on X on Sunday, November 1 [2]. Hours earlier its fourth recovery update had set a three-hour morning window for the restart [1], and Reuters reported that Binance's status page showed the planned withdrawals had begun early in the day [5].

The more telling post came about half an hour later. "We have updated our list of Proof of Reserves addresses to include newly generated wallet addresses. Going forward, all withdrawals will be processed from these new wallet addresses," Binance wrote [3]. It fits what co-CEO Richard Teng had promised, a withdrawal service rebuilt before it was switched back on [14], and it means the address that paid out the stolen 18,270 BTC is no longer the one customers are paid from.

Checking the address against Binance's list

Binance's proof of reserves page links to a file of new wallet addresses, and we downloaded it [4]. It holds 119 addresses across several networks, each with a zero balance at a given block height. Only one is a bitcoin address, bc1qhp7n555hk5mxlp3pz0347nzah8gazwe7wp5fjj, recorded at block 973,895 [4]. That is the address the chain shows acting as the new hot wallet, so we attribute it to Binance on the strength of the exchange's own list.

Its money came from inside the house. In block 974,088, mined on November 1, cold wallet 3M219KR5, which Binance named as its own in 2022, sent 20,000 BTC to 1Pzaqw98, another address on Binance's reserve list [11]. That address then forwarded 9,201 BTC to the new wallet in round-number chunks, and five more reserve-list addresses added 1,700 BTC [11]. All six appear in the reserve file Binance took at block 973,895, for a total of 10,901 BTC from attributable sources [4][11].

One more top-up, 500 BTC, came from an address that had received 887 BTC from 3M219KR5 in that same block but appears on no Binance list [11]. We count that as unattributed.

Binance's new hot wallet paid 8,800.8 BTC to outside addresses in 15 blocks. Before the hack, the old one paid 4,306 BTC on a normal day [11].

What has gone out since the restart

The first payouts landed in block 974,088. From there through block 974,102, the last block in our November 1 reading, bc1qhp7n sent 8,800.8 BTC to outside addresses in 157 transactions carrying 9,058 individual payments [11]. Before the restart it had made a single 0.00016 BTC test payment [11].

Those are batched transactions, each paying hundreds of recipients at once, the usual shape of exchange withdrawals. For scale, the old hot wallet paid 4,306 BTC across 747 transactions in the 24 hours before the theft, so the new one passed a full day's volume within 15 blocks [11]. A backlog built up during the pause would explain the pace, though the chain cannot tell a customer withdrawal from any other payment to a third party.

At the time of our reading, the new address also had transactions waiting in the mempool, worth another 111 BTC across 269 payments, plus a fresh 2,000 BTC top-up from 1Pzaqw98 [11]. Its confirmed balance stood at 2,500.3 BTC [11].

The old wallet and the stolen coins

The hacked hot wallet, bc1qm34l…7s3h, paid nothing to outside addresses after the restart [11]. It last spent coins in block 973,754, early on October 30, when it sent 2 BTC to 3M219KR5, and has only received funds since [11]. It held 5.5 BTC and is still listed in Binance's reserve file alongside the cold wallets [4][11].

The stolen bitcoin has not moved either. The 19 large outputs holding the attacker's 18,270.2 BTC, linked to the theft by Bitquery and Elliptic, were all unspent at block 974,102 [11][12][13]. Our piece on the recovery gap explains why those coins cannot be frozen the way the stablecoins were.

Nor have the 7,499 BTC that Binance said it moved out of its SAFU emergency fund on October 31 [10]. The receiving address is not on the reserve list and held 7,500 BTC in our reading [4][11].

The view from the queue

Once bitcoin opened, the questions under Binance's posts changed. People stopped asking when and started asking about their own coins, USDT on BNB Smart Chain, SOL, Tron, and one user complained that 40 minutes had passed since bitcoin reopened with nothing for anyone else [8]. Binance's support account kept replying with the same list of networks and the same promise that the rest would follow in phases [8].

The payouts themselves skew small. Half of the new wallet's payments were under 0.01 BTC, and 94% were under 1 BTC [11]. At the other end, 16 payments of 100 BTC or more added up to 3,742 BTC, about 43% of the total [11]. Many recipients and modest sums, which is what a lot of individual customers pulling their savings out would look like, although one payment is not always one person.

Binance had warned of delays and longer processing times from traffic, and told users to retry after a short while if a withdrawal did not go through [1]. It later reopened ETH, USDT and USDC on Ethereum and BNB, USDT and USDC on BNB Smart Chain [7]. Its support account says phase one covers selected assets across 15 networks [8].

Where the hack stands

The restart comes a day after the FBI named a culprit. On October 31 it said North Korea was responsible, pinning the theft on the unit it calls TraderTraitor and saying the actors had been converting stolen assets mainly into ETH [9]. Donald Trump told reporters the same day that the US was not certain North Korea was involved, Reuters reported [5].

Binance says it has covered about 95% of the loss, with balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC fully backed [1]. The remaining 5% is in less liquid tokens that take longer to buy, according to the exchange [1]. It has drawn on the SAFU fund, part of its futures insurance fund and its corporate treasury, and expects the full zero-knowledge proof of its reserves around Tuesday, November 3 [10].

What comes next

The rest of phase one, the full reserve proof and the post-incident report Binance has promised are all pending [1][10]. The part that can be verified is in plain view. Every payout from the new wallet appears in the next block, just as the theft did, and anyone can match the address against the list the exchange itself publishes. We track the effect on the bitcoin market separately, with on-chain data.

Sources

Source type in brackets. All times UTC. Accessed November 1, 2026.

  1. Binance, Security Incident | Recovery Update #4: Withdrawals Resume in Phases, X article, 04:11 UTC on November 1, 2026. Phase one between 06:00 and 09:00 UTC, possible delays, about 95% covered, ten assets fully backed. (Primary, company)
  2. Binance, post on X, 06:20 UTC on November 1, 2026. (Primary, company)
  3. Binance, post on X, 06:53 UTC on November 1, 2026, on the new proof of reserves addresses. (Primary, company)
  4. Binance, Proof of Reserves, address files for the October 31, 2026 snapshot. PR31OCT26_New_Wallet_Address.csv (119 new addresses, one bitcoin address, bc1qhp7n…5fjj, block 973,895) and PR31OCT26_HotCold.csv (includes 3M219K…jxRP6, 1Pzaqw…rE7, 31jUs8…UiUba, 3Kyo49…vkA1EM, 3KRduE…dxFLZ, 3Q6ZCg…smsR and bc1qm34l…7s3h, block 973,895). (Primary, company)
  5. Reuters, Binance resumes bitcoin withdrawals after covering bulk of stolen $6.3 billion, November 1, 2026, via Investing.com. Binance status page shortly after 06:00 GMT and remarks by Donald Trump. (Secondary, wire)
  6. AFP, Binance says resuming withdrawals after major hack, November 1, 2026. (Secondary, wire)
  7. Binance, Withdrawal Update, post on X, 07:49 UTC on November 1, 2026. (Primary, company)
  8. Binance Customer Support, replies to users on X on November 1, 2026, including 08:04 UTC, to a complaint about the wait, 07:53 UTC, on the new addresses and 08:06 UTC, listing the reopened networks. (Primary, company)
  9. FBI Cyber Branch, post on X, 22:36 UTC on October 31, 2026, and FBI, North Korea responsible for $6 billion Binance attack. (Primary, government)
  10. Binance, Security Incident | Update #3: 90% of Stolen Assets Replenished; Proof of Reserves Snapshot Provided, X article, 14:30 UTC on October 31, 2026, and post on the SAFU transfer, 16:15 UTC on October 31, 2026 (transaction 774fcb97…14bd, 7,499 BTC). (Primary, company)
  11. mempool.space, our own reading of the new wallet bc1qhp7n…5fjj, the hot wallet bc1qm34l…7s3h, 60 bitcoin addresses attributed to Binance including 3M219K…jxRP6 and 1Pzaqw…rE7, and the 19 large outputs holding the stolen lots. Restart counted from 06:00 UTC on November 1. Read at block 974,102 (08:09 UTC on November 1, 2026). Pre-hack baseline from our October 31 reading at block 973,947. (Primary, on-chain)
  12. Bitquery, Binance hack investigation, section "The record," listing the 19 lot addresses. (Secondary, on-chain analysis)
  13. Elliptic, Binance hack 2026 blocklist. (Secondary, on-chain analysis)
  14. Richard Teng, An update on the security incident, video on X, 14:32 UTC on October 30, 2026, and Binance, Security Incident | Recovery Update #2, 19:58 UTC on October 30, 2026. (Primary, company)

More in Price and market

See all 20 articles in Price and market →

Last updated: November 1, 2026