Binance reopens withdrawals following the 6 billion hack. The situation for Italian users
It should be noted that, as of 1 July, Binance users in Italia can no longer buy or trade, as Binance has not obtained the European MiCA licence
Customers of Binance who were ‘stranded’ following the $6.3 billion hack on Thursday 29 October can now start withdrawing their funds again, a little at a time. On Sunday 1 November, between 7am and 10am Italian time, the exchange began the first phase of reopening. It started with the Bitcoin network and is continuing with around fifteen tokens, including ether, USDT, USDC, BNB, Solana and XRP. No date has yet been set for the others. “Restoring access to users’ funds is a priority, and we are taking a controlled approach to do so safely,” reads a statement from the company. The reopening applies to all countries, including Italy, and brings to an end a two-and-a-half-day suspension.
It should be noted that, from 1 July, users of Binance in Italia can no longer buy or trade, as Binance has not obtained the European MiCA licence. The regulation on crypto-assets ended the transitional period on 30 June 2026: since then, only those authorised as crypto-asset service providers (CASP) may serve EU residents. Binance has withdrawn the application it submitted in Greece and has left Italian users with only two options: to close their positions and to withdraw funds.
The Stolen Badge
What happened? On Thursday 29 October, shortly after 9.00 pm Italian time, around 6.3 billion dollars were drained from Binance wallets across ten blockchains. This is roughly four times the 1.5 billion theft suffered by Bybit in February 2025. TRM Labs and Chainalysis attribute the incident to TraderTraitor, a group linked to North Korea, and on Saturday the FBI confirmed the link to Pyongyang.
To understand what happened, let’s think of Binance as a large bank. The bulk of the money is kept in the vault, locked away and offline (the cold wallet), whilst a portion is held in the tellers’ cash desk to cover day-to-day withdrawals (the hot wallet). The thieves didn’t break into the vault and didn’t copy the keys: they stole an employee’s access badge. According to Binance, the breach began with the laptop of an engineer, from which the attacker gained access to an internal system and sent unauthorised withdrawal orders. The system recognised them as ‘signed’ and executed them. Around 3 billion have been frozen, mainly stablecoins such as USDT and USDC, which the issuers can block: they are like banknotes with flagged serial numbers. Bitcoins are like cash: once they’re out, they can’t be stopped.
Reserves without an auditor
Who will foot the bill? “Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users,” the company assures in its statement. Binance has set aside over 6.34 billion of its own funds and states that it has already covered approximately 95 per cent of the amount stolen, up from 90 per cent in the previous update. The remaining 5 per cent relates to less liquid tokens, outside the top ten, which the exchange is repurchasing on the market and via OTC channels. For the major cryptocurrencies – from Bitcoin and Ether to the stablecoins USDT and USDC – the company states that balances are 100 per cent covered, verifiable via proof of reserves. This is a self-certified verification. In December 2022, a few weeks after the FTX collapse, the French audit firm Mazars suspended its work with the entire crypto sector. Since then, no external auditor has signed off on Binance’s reserve accounts, which are based on cryptographic instruments managed by the exchange itself.
