November 03, 2026

Binance reopened withdrawals — and the scammers clocked in

On November 1 Binance began reopening withdrawals in phases after the October 29 hack. In the first 9.5 hours users withdrew $4.65B and deposited $1.01B — the exchange's own figures. The next phase is set for November 3.

WHAT WE KNOW AS OF NOVEMBER 2

• Binance: about 95% of the loss is covered, and 10 main coins (BTC, ETH, USDT, BNB, SOL, USDC and others) are 100% backed.
• Withdrawals go out from new hot-wallet addresses, which Binance added to its proof-of-reserves report.
• On October 31 the FBI attributed the attack to North Korea's TraderTraitor group and published 628 addresses, asking services to block them.
• The hacker sent about $250K to Gate — Gate froze two linked accounts.
• Elliptic estimates $2.85B frozen or seized, while $3.25B (including about 18.3K BTC) cannot be frozen.
• We checked the receiving address 0x5227…2f8c: risk 100 of 100, flagged as a hacker address, about $2.1B still listed on it.

THE SECOND WAVE IS AIMED AT YOU

• "$150 compensation for the withdrawal pause" is fake. Binance said plainly: there is no payout for the pause.
• Telegram users receive 0.1 GRAM with an "official Binance notice": move everything to a "Binance Vault" on a third-party site. There is no such vault.
• Binance does run a real 100 USDC voucher promo right now — inside the app only. It is already being copied.
• If you just withdrew to your own wallet, you are the new target. Expect "urgent" signature requests and "wallet checks".

WHAT TO DO TODAY

• Check any "compensation" or "promo" inside the exchange app only, never via a link in your DMs.
• Don't sign anything to "get money back": approve and permit grant access to your tokens.
• Turn on the withdrawal address whitelist and an anti-phishing code — step-by-step guides with screenshots are coming on November 4 and 5.
• Got a transfer from an unknown address? Check it first.

Sources: Binance, FBI, Gate, Elliptic, Lookonchain.

Check an address for free: https://t.me/amlconsensus_bot?start=en