Binance warns of second wave of crypto theft as $6.3 billion hack recovery continues

Binance has warned customers about potential scams exploiting withdrawal delays as the exchange recovers from a $6.3 billion security breach.

In a Nov. 2 security advisory, the exchange said fraudsters could take advantage of its phased withdrawal reopening by impersonating Binance representatives and offering customers assistance with delayed transactions, compensation claims and asset recovery.

The warning covers fraudulent emails, direct messages, group chats and even small cryptocurrency transfers carrying malicious instructions.

According to Binance, scammers may promise to speed up pending withdrawals, sell customers priority access to withdrawal queues, or instruct them to transfer their holdings into supposedly secure wallets.

The exchange emphasized that it does not charge fees to unlock withdrawals, offer paid recovery services or ask customers to authorize wallet transactions to regain access to their funds.

It also warned against fraudulent proof-of-reserves websites and compensation eligibility links, which could become particularly deceptive as the exchange introduces new verification tools following the breach.

Once customers approve malicious wallet permissions, attackers can transfer their assets without further authorization, potentially creating losses that cannot be reversed.

The warning comes as Binance attempts to restore normal operations after an Oct. 29 attack that compromised its hot wallets and resulted in approximately $6.3 billion in stolen cryptocurrencies.

Meanwhile, Binance announced on Nov. 2 that it had completed the zero-knowledge proof for its Oct. 31 reserve snapshot, allowing customers to independently verify the backing of ten major cryptocurrencies.

The covered assets include Bitcoin, Ethereum, BNB, XRP, Solana, Zcash, and four stablecoins: USDT, USDC, USD1, and RLUSD.