Binance Restores Withdrawals in Phased Rollout After $6.3B Hack

Binance has begun a controlled resumption of customer withdrawals following the massive security breach that saw roughly $6.3 billion taken from its hot wallets. The exchange opened the initial withdrawal window on 2026-11-01 between 06:00 and 09:00 UTC, prioritizing the most-requested networks to ensure a safe and stable restart.

The company emphasized a cautious, phased approach: each blockchain must clear security and stability checks before additional withdrawal windows open. Binance stated that restoring user access to funds is its top priority, and that it will continue to monitor systems closely as services are restored in stages.

Assets Reopened and Recovery Progress

Withdrawals for several major assets were among the first to be reinstated, including bitcoin (BTC), ether (ETH), USDT, USDC, BNB, and XRP. Binance indicated that networks with the highest user demand were prioritized for the initial phase.

Key figures reported by blockchain analytics firms show the attacker moved large quantities across chains: roughly 18,270 BTC, about 200,630 ETH, 1.875 billion USDT, 823 million USDC on Ethereum, 233.46 million XRP, 970,500 SOL, and additional USDT on other blockchains. Analytics firms have attributed the exploit to a group known as TraderTraitor, which some link to North Korea.

How Binance is Covering Losses

Binance said it has already replaced approximately 95% of the affected assets using company funds, up from 90% in an earlier update. The replacement includes assets sourced from its emergency reserve—the Secure Asset Fund for Users—and other company resources. The exchange stressed that users will not bear the financial losses; Binance will absorb the impact itself.

Some assets remain harder to replace because they are less liquid. Binance explained the remaining ~5% consists of tokens outside the top-listed assets, which require more time to source at scale through market and OTC channels.

Funds Immobilized and Proof of Reserves

Binance reported that around $3 billion of stolen funds have been immobilized, mostly in stablecoins such as USDT and USDC—assets whose issuers can block or freeze transfers. In contrast, assets like bitcoin and ether cannot be frozen in the same manner.

The exchange has pledged a full proof-of-reserves report to verify that customer balances are backed by the assets Binance holds. Users are directed to the PoR website to confirm the snapshot once published.

Ongoing Actions and User Assurance

Binance reiterated that resuming withdrawals marks a major milestone but not the end of its recovery efforts. The company will continue strengthening safeguards, completing the recovery process, and sharing updates as it progresses.

Note: Additional withdrawal phases will depend on individual blockchains meeting security and stability requirements before they are reopened.