Binance Warns of Fake Compensation Scams After $6.3B Hot Wallet Breach

Fee-for-Speed Promises Flagged as Scams

Binance has warned users that impostors are circling the phased restart of its withdrawal services, telling customers that anyone promising faster processing for a fee is running a scam. The exchange published the alert on its official X account on Nov. 2, one day after withdrawals went live again on 15 networks, and said opportunistic fraudsters may try to exploit the recovery window while service is still being restored.

The tactics it described are varied. Scammers may pose as Binance through direct messages, emails, group chats, and even micro-transfers that carry an attached note, claiming they can “expedite withdrawals,” arrange “priority processing,” help users “claim compensation,” or move funds into a “Binance vault.” The exchange stated plainly that it never contacts users first about accounts or funds, never sells places in the withdrawal queue, and never charges fees to unlock networks or assets. Requests to transfer to a “safe account,” connect a wallet, sign a transaction or grant access can hand third parties control of funds, and on-chain transfers are usually impossible to reverse. Binance added that it never asks for passwords, two-factor codes or seed phrases, and never sends unsolicited eligibility checks, account-status inquiries or claim links. An image circulating online that appears to show compensation for the withdrawal suspension is digitally altered, according to the exchange’s official response. The US Federal Trade Commission has issued a parallel consumer alert that refund and asset-recovery scammers impersonate organizations to demand upfront fees or financial details. Binance has likewise rejected paid recovery services and directs clients with pending withdrawals to check status in the app; its official verification page can authenticate channels, accounts and websites, and anyone concerned about account security should change their password, review settings and contact in-app support.

$3.64 Billion Net Outflow After the Restart

The warning landed while Binance was still working through the aftermath of the Oct. 30 hot wallet breach, which it estimates at roughly $6.3 billion in affected assets, a loss the company says it will absorb in full. Withdrawals restarted on Nov. 1 beginning at 06:00 UTC, unlocked asset by asset and network by network. In the first nine and a half hours, through 15:30 UTC, the platform processed $4.649 billion in withdrawals against $1.01 billion in deposits, a net outflow of about $3.64 billion. That equals 2.1% of the exchange's total assets as measured on Oct. 28.

Company-funded replenishment of the affected assets had reached 90% by Oct. 31 and about 95% by Nov. 1, and the company reiterated that users bear no financial loss from the stolen funds. The remaining 5% sits in low-liquidity tokens outside the ten major assets, with industry partners helping to source alternatives; the replenishment share is distinct from whatever the attacker has returned. Alongside the restart, Binance published a new proof of reserves built on a snapshot taken at 00:00 UTC on Oct. 31, covering Bitcoin (BTC), Ethereum (ETH), Tether (USDT), BNB, Solana (SOL), USDC, XRP, USD1, RLUSD and ZEC. Holders can confirm their balances were backed at least 1:1 at that moment without individual balances being disclosed; the zero-knowledge proof was completed on Nov. 2, and the verification tool runs on the user's own computer from open-source code. The next phase of withdrawals is scheduled for Nov. 3, with a broader reserve snapshot planned for Nov. 4 that the company expects to take 40 to 50 hours to generate.

The scale of the first-day flows suggests the restart passed without visible stress: a net $3.64 billion left the platform in under ten hours, yet that was only 2.1% of holdings, and the queue cleared alongside a phased security review. The scam wave is a matter of timing rather than a new threat vector, since social-engineering attempts cluster whenever users are anxious and refreshing withdrawal statuses. Publishing a zero-knowledge proof of reserves for ten assets within days of a $6.3 billion breach sets a fast template for incident response, though the harder problem is the 5% tail of illiquid tokens, which cannot be repurchased quickly without moving thin markets. The Nov. 4 snapshot will show whether that shortfall keeps shrinking. Users comparing custodial venues after the incident can review the Best Crypto Exchanges roundup.