An exit can fail in two different ways: the venue can stop withdrawals, or a trade can execute at a punishing price. Binance’s incident put both mechanisms on the record, but they affected different holders. In its October 30 update, Binance said withdrawals were temporarily suspended while security checks were completed, while deposits continued normally. Separately, TRM Labs reconstructed an attacker selling USDT for ether at terms well below the token’s nominal dollar value.
The first is an access problem; the second is a conversion cost. A dollar-denominated balance, permission to move it and the value received in a trade are not interchangeable assurances.
Co-CEO Yi He’s service estimate concerned the start of withdrawal resumption, not completion. A FinanceFeeds report dated October 30 reproduced her wording: “We expect to begin resume withdrawal services in the next 48 hours.” That is a forward-looking estimate, not a guaranteed restart time. Binance’s service statement and the executive’s estimate should not be read as confirmation that withdrawals have resumed.
The denominator changes the story
In its on-chain reconstruction, TRM reported about 325 million USDT sold to professional fillers and market makers through UniswapX and other intent-based contracts for about 122,300 ETH. TRM described a discount of more than 10%, using an ether benchmark of $2,300 to $2,350.
Divide the amounts and the attacker paid approximately 2,657 USDT per ETH. Against that benchmark, ether was bought at a premium. Reverse the denominator and the same trade values each USDT surrendered at approximately 86.6 to 88.4 cents of ether. That is where the USDT discount appears. These are calculations from TRM’s approximate quantities and benchmark, not an independently reconciled fill ledger.
The distinction matters. A trade involving stolen stablecoins is not a quote for every holder of the token. The reconstructed exchange ratio does not by itself establish a market-wide USDT price or depeg. Nor does it explain how much of the spread came from liquidity, urgency or the risk attached to these funds.
The freeze totals have their own denominators too. TRM counted approximately $2.67 billion in stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial as of 00:30 UTC on October 30. Including roughly $30 million in ETH and ARB immobilized by Arbitrum’s Security Council, its total was about $2.7 billion. Binance’s update separately reported roughly $3 billion frozen on-chain. These are overlapping accounts with different scopes and cut-offs, not amounts to add together.
A reserve ratio is a different answer
Binance’s reserve dashboard displayed Audit Time 01/10/26 00:00:00 UTC, BTC block height 969369, and ratios of 100.35% for BTC, 100.00% for ETH, 103.88% for USDT and 108.26% for USDC. The numeric date’s format is unresolved; it is not converted here or characterized as before or after the incident. Binance’s update states that an updated Proof of Reserves will be published once remediation is complete. That is its intention, not a claim about whether another report exists.
Our initial incident report, freeze playbook, exchange account and RLUSD and XRP coverage address the breach and issuer boundaries. This is the separate money consequence: a reserve display answers neither when a withdrawal will execute nor what value a particular conversion will deliver. Counterparty assessment has to keep those questions separate.