Binance resumes withdrawals in phases after $6.3 billion hack, saying 95% of stolen assets are now covered
Binance has reopened withdrawals in phases on Sunday, starting with Bitcoin, after covering about 95% of the $6.3 billion stolen in its 29 October security breach, with users warned of possible delays as traffic surges.
Binance, the world’s largest cryptocurrency exchange, resumed withdrawals on Sunday, 1 November 2026, in a phased return to service after the record $6.3 billion security breach on 29 October that forced it to suspend withdrawals while it assessed the damage and secured its systems. The reopening, which began with Bitcoin, is the first time customers have been able to move funds out of the exchange since the incident, and it marks the most concrete step yet in Binance’s recovery from the largest digital-asset theft on record.
According to Binance’s recovery update, phase one of the resumption was scheduled between 06:00 and 09:00 UTC on Sunday — 11:00am to 2:00pm Pakistan time — and the exchange said on its status page shortly after 06:00 UTC that the planned withdrawals had begun. Founder Changpeng Zhao confirmed the first step in a short post, writing simply: “BTC withdrawal is live.” The exchange stressed that the return is being done network by network and asset by asset, rather than all at once, so that each route can be checked for security and stability before it is reopened.
The first phase covers 15 blockchain networks, including Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, the XRP Ledger, Zcash and Dogecoin, as well as Polygon, Avalanche, Arbitrum, Base, Optimism, TON and Sui. The assets listed for the first batch include Bitcoin, Ether, BNB, Solana, XRP, Dogecoin, Zcash and the stablecoins USDT and USDC, among others. Binance said it chose the order using withdrawal demand recorded over the previous week, so the most-used routes came first, and that other networks and assets will be added once they pass further security checks.
Bitcoin withdrawals came first, followed during Sunday by Ether and the stablecoins on Ethereum and on BNB Smart Chain, according to TradingView’s report of the rollout. Binance warned from the start that users might face temporary delays or longer processing times during the first wave of withdrawals, because of the volume of traffic as customers who had been unable to move funds for three days returned at once. Deposits, by contrast, had remained open throughout the suspension and were not affected by the incident.
Alongside the resumption, Binance raised its replenishment figure to about 95% of the stolen assets, up from 90% in its 31 October update and 80% before that. Reuters reported that Binance said it had covered $6 billion of the stolen cryptocurrencies by using company money to buy replacement tokens. Co-chief executive Richard Teng said the company would absorb the financial impact of the breach, repeating the exchange’s assurance that user funds remain safe and that users will not bear the loss.
The breach itself took place on 29 October, when about $6.3 billion was drained from Binance hot wallets — wallets connected to the internet and used for day-to-day transactions — across several blockchain networks. On Saturday, the United States Federal Bureau of Investigation said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, saying malicious actors from North Korea had been observed laundering the stolen assets by converting them into Ethereum and warning that further laundering stages were expected. Binance and its partners have also said around $3 billion worth of the stolen assets have been frozen or located.
Binance has also published an updated Proof of Reserves snapshot, saying balances in major assets including Bitcoin, Ether, USDC, BNB, Solana, XRP and Zcash are now fully backed, with full cryptographic verification expected by Tuesday, 3 November. A detailed post-incident report is also being prepared, the exchange said, setting out the impact of the breach and the steps taken in response. No fixed timetable has been given for restoring withdrawals for the remaining assets; Binance says those wallets are still undergoing repeated security audits and perimeter checks, prioritised by market capitalisation, locked funds and user base.
In market terms, the resumption came against a mixed backdrop. Figures checked at 14:52 PKT on 01 November 2026 put Bitcoin near $77,700, up about 0.65% on the day, and Ether near $2,265, up about 1.1%, according to Sunday market summaries — a surprisingly resilient showing for cryptocurrencies given the scale of the hack. Wider markets were weaker: United States equities ended the previous week sharply lower, with the S&P 500 down 1.82% and the Nasdaq down 2.86%, while gold fell to about $3,899 an ounce and Brent crude traded near $113 a barrel amid continuing Middle East tensions.
For Binance users, the practical advice from the exchange is to check its official withdrawal page or network status page for the exact asset and network they want to use, rather than assuming every route is live, and to retry after a short while if a withdrawal does not go through during the initial surge. For the wider crypto market, the phased reopening is being watched as a test of confidence: whether withdrawals proceed smoothly, whether the remaining 5% of assets is covered, and whether the frozen portion of the stolen funds can be recovered will shape how quickly trust in the exchange — and in large centralised exchanges more generally — is restored.
What happens next is therefore in stages. Further phases of withdrawals depend on security assessments and user demand, the full Proof of Reserves verification is due by 3 November, and investigators in the United States continue to track the laundered funds linked by the FBI to North Korea. For now, the confirmed development is clear: after three days of suspended withdrawals, Binance has begun letting customers take funds out again, starting with Bitcoin, with about 95% of the stolen value replaced from company funds.
This post is market news information only, not financial advice.
