Binance Reopens Withdrawals in Phases After Record $6.3 Billion Hack
Binance, the world’s largest cryptocurrency exchange, began restoring customer withdrawals on Sunday, November 1, three days after hackers drained about $6.3 billion from its hot wallets in what is now ranked as the largest theft in crypto history. The phased reopening, rolled out network by network, is the first real test of whether the exchange can rebuild confidence after an attack that rattled digital asset markets and drew in the FBI.
Bitcoin was the first network to reopen, followed by Ethereum, BNB Chain, XRP and Base, with Polygon and Avalanche added in later updates on Sunday, according to Binance’s own rollout posts. More networks and tokens will follow progressively once security checks are complete, and the exchange warned users to expect temporary delays during the early rollout because of heavy traffic. Deposits, Binance said, had stayed available throughout the incident.
For American crypto holders, the reopening matters beyond a single company. Binance remains a central venue for trading Bitcoin, Ether and stablecoins, and the attack briefly knocked Bitcoin more than 3% lower to a six-week low near $76,000, according to market coverage of the incident. Leveraged traders took the hardest hit, with liquidations topping $628 million in an hour, mostly from long positions, CoinGlass data cited in that coverage showed.
How the phased withdrawal restart works
Rather than switching everything back on at once, Binance is reopening transfers in stages. Each network and asset pair is restored only after its own security checks are finished, a cautious approach that limits the damage if a problem is found in one part of the system.
In its Sunday updates, the exchange listed Bitcoin, Ethereum (including USDT and USDC), BNB Chain (BNB, USDT and USDC), XRP, and Base (ETH and USDC) among the networks already enabled, with Polygon (POL, USDT and USDC) and Avalanche (AVAX, USDT and USDC) added as new. The company said it was prioritising tokens according to user demand over the past week, so the most-used networks came back first. Users whose withdrawals fail in the early hours were advised to wait and try again.
What was stolen, and who is blamed
The breach began on Thursday, October 29. Attackers drained about $6.3 billion from Binance hot wallets across multiple blockchains in under four hours, with most of the funds leaving within roughly 20 minutes, according to reports of the incident. Hot wallets are the internet-connected wallets exchanges use for day-to-day withdrawals, which makes them faster to operate but more exposed than offline cold storage.
The scale dwarfs the previous record. The theft is now described as far above the roughly $1.5 billion Bybit hack in 2025, a comparison that underlines why regulators and rival exchanges have watched Binance’s response so closely.
On October 31, the FBI’s cyber branch said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, and urged the industry to block related addresses. Analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korea-linked hacking group, according to coverage of the investigation. Binance co-CEO Richard Teng has said investigators found additional breach points beyond an initially suspected compromised employee laptop. Separately, industry partners including Tether and Circle froze an estimated $2.7 billion to $3 billion of the stolen assets, a pool Binance counts apart from the replacement tokens it has assembled itself.
How Binance says it is covering the $6.3 billion
Binance has said it will absorb the financial impact itself, not its users. In an October 31 post quoted in coverage, the exchange said: “Binance will absorb the financial impact of these stolen funds, not our users.” It said it had already reserved more than $6.34 billion of company funds to cover the incident, including $5 billion held in the exact tokens that were stolen.
The bill is being paid from three of the company’s own pools: its general treasury, a drawdown of the Secure Asset Fund for Users (SAFU), and money ring-fenced for losses on its derivatives desks. SAFU is the emergency user-protection reserve Binance builds from trading fees. Binance has committed to restoring SAFU to about $1 billion after the partial draw, which means the fund that protects users in a collapse is thinner during the recovery window.
The coverage figure moved over the weekend. Reports on Saturday put the replenished share at about 90% of the roughly $6.3 billion stolen, up from 80% a day earlier. By Sunday, Binance’s updates put the covered share at about 95%. The remaining gap consists largely of less liquid tokens, which Binance is buying through market and over-the-counter channels. Customer holdings of Bitcoin, Ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now described by Binance as fully backed.
What is verified, and what is not yet proven
Every recovery figure so far is Binance’s own report, and that distinction matters. Security firm CertiK said on Friday it could not yet confirm the $5 billion in replacement cryptocurrencies because it had not received enough detail. Binance itself has said generating a full zero-knowledge proof of reserves takes 40 to 50 hours because of the computational workload, with the full proof expected by November 3 on its proof-of-reserves page. How much each funding source contributed, and how much of the stolen crypto has been recovered rather than replaced with new tokens, has not been disclosed.
For US investors, three lessons stand out. First, exchange risk is real even at the largest venues: a hot-wallet breach can freeze withdrawals for days. Second, the speed of the response matters as much as the size of the reserve: Binance’s phased restart and public rollout list are aimed at proving, network by network, that the system works again. Third, attribution changes the stakes: an FBI finding pointing to a state-linked hacking group puts the incident in a different category from an ordinary theft, with implications for sanctions and frozen funds.
The watch points are now clear: whether the remaining networks reopen on schedule, whether the November 3 proof of reserves stands up to independent scrutiny, and whether any of the frozen $2.7 billion to $3 billion can be returned. NationWire will update this story as each of those milestones lands.
Frequently Asked Questions
Are Binance withdrawals open again?
Yes, in phases. Binance began restoring withdrawals on Sunday, November 1, starting with Bitcoin and adding Ethereum, BNB Chain, XRP, Base, Polygon and Avalanche in successive updates. More networks are due to follow after security checks, and users may face temporary delays.
How much was stolen in the Binance hack?
About $6.3 billion in cryptocurrency was drained from Binance hot wallets on October 29, 2026, in under four hours. It is now ranked as the largest hack in crypto history, far above the roughly $1.5 billion Bybit hack in 2025.
Will Binance users lose money?
Binance says no. The exchange says it will absorb the full impact from its own treasury, its SAFU emergency reserve and its derivatives insurance fund, and that customer balances in major tokens are fully backed. Independent verification of the replacement funds is still pending.
Who is blamed for the hack?
The FBI has attributed the theft to North Korea, and analytics firms TRM Labs and Chainalysis have linked it to TraderTraitor, a North Korea-linked hacking group.
When will Binance publish full proof of reserves?
Binance has said a full cryptographic, zero-knowledge proof of reserves is expected by November 3, 2026. It has already posted a reserve snapshot, but CertiK said it could not yet confirm the $5 billion in replacement tokens without more detail.
Sources: BeInCrypto, “Binance Resumes Crypto Withdrawals After Record Hack, 95% of Losses Covered” (https://beincrypto.com/binance-restores-withdrawals-after-hack/); CryptoDnes, “Inside Binance’s war chest: how a $6.3B hack gets absorbed without touching user balances” (https://cryptodnes.bg/en/inside-binances-war-chest-how-a-6-3b-hack-gets-absorbed-without-touching-user-balances/); TradingView / Cointelegraph, “Binance Covers 90% of $6.3 Billion in Hacked Assets, Keeps Nov. 1 Withdrawal Restart Plan” (https://www.tradingview.com/news/bloomingbit:89ccdffe5094b:0-binance-covers-90-of-6-3-billion-in-hacked-assets-keeps-nov-1-withdrawal-restart-plan/).
