Withdrawals Reopen at Binance After the $6.3 Billion Hack — In Careful, Watched Stages

Binance began restoring cryptocurrency withdrawals in controlled phases on Sunday, 1 November, after suspending them during its response to a reported $6.3 billion security incident. Bitcoin withdrawals on the Bitcoin network were first to resume, with the initial phase scheduled between 06:00 and 09:00 UTC. Other supported assets and networks were to be enabled progressively after security checks; Binance said deposits had remained open. The reopening put the exchange’s assurances about user funds and recovery to an early practical test.

The exchange’s published rollout listed 15 networks: Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Zcash, Dogecoin, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism, TON and Sui. Binance cautioned that inclusion on the list did not mean every asset-network route would open at once. It said sequencing would reflect recent withdrawal demand and that security and stability checks would precede each activation. Customers were told to check the withdrawal page for current availability; the timing of further phases was not fixed.

Binance said it had replenished approximately 95 per cent of the affected assets, up from 90 per cent in its previous update, and pledged to absorb the financial impact. It also said it had reserved more than $6.34 billion in company resources to cover the affected assets. Binance reported that balances of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed; it said the remaining five per cent involved lower-liquidity tokens that would take longer to source. These are figures supplied by the exchange and have not yet been independently verified in a complete cryptographic proof.

The exchange said its 31 October proof-of-reserves snapshot showed the listed balances fully backed and that a complete zero-knowledge proof was expected by Tuesday, 3 November. Binance also said it would restore its Secure Asset Fund for Users (SAFU) to around $1 billion after drawing on reserves during the recovery. The snapshot and replenishment claims are part of Binance’s account of its response; publication of the full proof will provide a further check on the stated balances.

How the breach occurred remains under investigation. Binance’s preliminary findings pointed to a potentially compromised DevOps employee laptop, while the company later said investigators had identified additional breach points and that the laptop was not the only factor. Binance said it had found no evidence that wallet private keys were exposed, revoked affected authorisations and revamped the withdrawal service. The FBI has attributed the activity to TraderTraitor, a group linked to North Korea, according to the Associated Press. Binance has said it plans to publish a fuller incident report after its investigation concludes.

The phased reopening is a milestone, but the recovery is not complete: Binance has not set a timetable for all remaining assets, and its full cryptographic proof was still pending as of Sunday. If the reported $6.3 billion figure is confirmed, the incident would rank among the largest cryptocurrency thefts by dollar value. The next tests are whether withdrawals continue to work securely, whether the outstanding assets are replenished, and whether the promised proof and post-incident report answer how the breach unfolded.