Binance to reopen withdrawals after billion-dollar hack
The crypto exchange reports replaced holdings. Swiss supervisory rules show why customers should also know the custodian and their rights in insolvency.
Binance intends to allow withdrawals again after the billion-dollar attack. In its announcement of 31 October, the crypto exchange named Sunday, 1 November 2026, as the date. It did not state an exact start time. According to the company, 90 percent of the stolen holdings have now been replaced.
This refers to replenishment by Binance, not to the attackers returning 90 percent of the loot. Bloomberg reported on the exchange's statements. Its promise to bear the losses itself must now prove itself in customers' access to their balances.
The proof covers a single cut-off date
Binance published a reserve position as of 31 October, 00:00 UTC. The company announced the full cryptographic proof for 3 November. The announced withdrawals are therefore due to begin earlier.
Such proofs, usually called "proof of reserves", are meant to make existing crypto holdings traceable. Their informative value depends on their scope and on the method used. The Office of the Investor Advocate at the US audit regulator PCAOB warned as early as 8 March 2023 against equating them with an audit.
The office explains that a snapshot, for example, does not guarantee that the recorded assets will still be available later. Depending on the verification method, liabilities, customer rights and internal controls also remain inadequately captured. This is a general warning about this form of reporting, not a finding about the current Binance proof.
In insolvency, legal allocation is what counts
For customers in Switzerland, the question of whether coins exist is therefore not enough. It also matters which company they entrust their assets to, where those assets are held, and whether customers can demand them back in the event of insolvency. FINMA clarified its supervisory practice on crypto custody in an announcement on 12 January 2026.
In addition to cyberattacks and the protection of private keys, it explicitly names counterparty risk. This arises, for example, when a commissioned custodian becomes insolvent and customer assets cannot be legally separated from its own assets. When custody is abroad, differing legal systems make the assessment even more difficult.
In FINMA's view, technical organisation is also part of custody. Anyone who controls private keys must protect them against loss and unauthorised access. The supervisory authority requires a robust infrastructure and corresponding expertise for this. A provider can therefore report sufficient holdings and still take considerable risks in safeguarding or managing those keys.
Swiss legislation permits, under certain conditions, the separation of crypto-based custody assets in bank insolvency. Such assets are excluded from the insolvency estate. However, this does not amount to blanket protection for every balance on a crypto platform. The specific custody structure and the legal requirements must match.
Outsourcing does not release Swiss institutions
For supervised Swiss institutions, responsibility remains even when they engage a foreign custodian. For such outsourcing, FINMA requires equivalent prudential supervision and equivalent protection in the event of insolvency. This means supervision of the provider's financial soundness, organisation and risks. Mere subjection to anti-money-laundering rules does not meet this requirement.
The supervisory authority allows narrowly limited exceptions for certain existing arrangements. For these, customers must be informed about the increased custody risks and appropriate alternatives and must consent in writing; the conditions apply together. Such an exception cannot be justified by a note in the fine print alone.
These requirements apply to institutions supervised by FINMA and to the business models described in the announcement. They are not a Swiss guarantee for all services of an international crypto exchange. Nor does the use of a Swiss customer access point or German-language contract documents in itself say anything about the actual place of custody.
Anyone comparing an offer therefore needs the name of the contracting party, details of the custodian and the contractual rules for the release of the assets. A securely held coin also remains exposed to price risk: FINMA explicitly states that protection in custody does not eliminate possible losses from price fluctuations. For Binance customers, the announced next step comes first: the actual resumption of withdrawals.
Sources
- Binance: Recovery Update #3 of 31 October 2026
- FINMA: Supervisory Announcement 01/2026 on crypto custody
- PCAOB Investor Advocate: limits of proof-of-reserve reports
- Bloomberg: Binance reports replaced holdings and announces withdrawals
- Wikimedia Commons: cryptocurrency logos by voytek pavlik
- Wikimedia Commons: Keyboard Close Up by Alexander-design
- Licence: CC0 1.0
