As Binance reopens withdrawals, UAE FSRA regulator issues statement

Binance has begun reopening withdrawals following the hack, starting with Bitcoin, as the incident continues to dominate headlines across crypto media. The Financial Services Regulatory Authority (FSRA) in ADGM, the UAE financial zone where Binance is licensed, has meanwhile issued a statement confirming that it is monitoring the incident and prioritizing clients’ interests.

Binance holds three separate licenses in ADGM under the FSRA oversight, as part of its strategy to strengthen its regulatory framework and enhance oversight of its global platform.

When it was granted these licenses, Binance noted, “Becoming regulated in ADGM means that our services are provided by entities that meet clear regulatory standards, including rules on governance, risk management, and customer protection.”

The global crypto exchange added that, under the UAE’s ADGM regulatory structure, services on the platform are provided through three ADGM-licensed entities, each operating within its regulatory permissions. This structure mirrors established financial market infrastructures, with a clear separation of responsibilities and strengthened risk controls.

The FSRA approved the three entities in ADGM in December. The first, Nest Exchange Limited, operates as an investment exchange and Multilateral Trading Facility, responsible for all exchange activities, including spot and derivatives trading.

The second, Nest Clearing and Custody Limited (formerly known as Binance (AD) Limited), acts as a Recognized Clearing House, with a stipulation to provide custody. It is responsible for clearing and settlement, acting as the central counter-party for on-exchange derivatives trades, and safeguarding users’ digital assets. The third, Nest Trading Limited (formerly known as BCI Limited), is a broker-dealer responsible for off-exchange activities and principal-based services, such as OTC trading, Convert and Earn.

Together, these arrangements were designed to bring Binance.com under a robust, globally recognized supervisory framework.

Against this regulatory backdrop, the FSRA today published its response to the hack, saying it was aware of the matter involving Binance and was working closely with the operator to monitor the incident.

It added, “Protecting the interests of clients and supporting the integrity and orderly functioning of markets remain the FSRA key priorities.”

Dubai’s VARA, which has also granted Binance a license, has not yet commented on the situation.

As regulators monitored the situation, Binance founder and former CEO Changpeng Zhao (CZ) highlighted the role of US law enforcement agencies in responding to the exchange’s roughly $6 billion hack, crediting them for their help. His comments on X came in reply to an FBI alert attributing the theft to North Korea’s “TraderTraitor” activity.

“US Law Enforcement agencies (FBI, USSS, IRS and more) provided vital help in this incident, including tracking, freezing, etc.,” CZ wrote. “A tweet can’t fully express our gratitude. Many crypto bros may not realize that a lot of the ‘why bitcoin didn’t drop more?’ credit goes to them.”

Turning to the exchange’s recovery efforts, Richard Teng reiterated in separate X posts that Binance had begun a phased resumption of withdrawals and had already replenished approximately 95% of the impacted assets. He added that Binance, not its users, would absorb the financial impact of the stolen funds.

Teng also thanked partners who acted quickly to freeze hacked assets, as well as law enforcement agencies around the world.

Elaborating on how Binance would replenish the assets, he stated, “Binance has reserved over $6.34B of company funds to cover the stolen assets. $5B of these funds are already held in the exact token assets that were impacted, such as USDC, USDT, BTC, ETH, BNB etc. We are working on the outstanding amount by buying the token assets through market and OTC channels. We will share more progress as soon as we can.”

Alongside that funding commitment, Teng emphasized the distinction between company and customer assets, stating, “Let me be direct about the first point. We NEVER use any customer funds, so they are not impacted. What was affected in this incident was Binance’s own hot wallet. User assets are held under Binance’s established security architecture. The vast majority sit in cold wallets and are only moved into a hot wallet when a user makes a withdrawal.”

While Binance works to replenish assets and restore withdrawals, a parallel investigation is tracing how the theft unfolded and where the stolen funds went. The exchange has been working with blockchain intelligence firms, token issuers and other exchanges to trace and recover those funds. Among them is Chainalysis, which recently published a blog post on the incident, describing it as the largest hack in crypto history and the single largest financial crime of all time.

As those recovery efforts continue, attribution has centered on the North Korean cybercrime group TraderTraitor, which has repeatedly targeted the cryptocurrency industry—including exchanges, DeFi protocols and investors—to raise funds for the regime.

Chainalysis’s account also provides a timeline of the theft: funds began leaving Binance hot wallets across multiple blockchains at 4:20 p.m. Eastern Time on October 29. On Ethereum, the attacker used an operational wallet funded through Tornado Cash to submit valid signed authorizations that allowed a Binance hot wallet to run attacker-deployed code. The attacker then called that wallet to sweep its assets into attacker-controlled addresses. Other affected Binance wallets appeared to send funds through ordinary signed transfers. Across the affected blockchains, the unauthorized transfers totaled approximately $6.4 billion USD.

Freezing funds takes time, and the attacker attempted to stay ahead of that process by quickly moving $500 million in stablecoins into a wallet used to swap freezable assets for non-freezable ones. Over nearly 20 minutes, the wallet swapped $325 million in stablecoins for $285 million in ETH. Ten minutes later, the exploiter sent the remaining $175 million in stablecoins to stopover wallets, likely to outpace a blacklist or freeze. The industry responded more quickly than the attacker appeared to anticipate by 5:14 p.m. Eastern Time, freezes had begun.

Chainalysis proactively shared investigative leads with industry partners to help identify and freeze stolen funds. Approximately $2.8 billion has been frozen so far. The firm also reported witnessing previously unseen laundering patterns for the first time: “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.”