Binance reopens withdrawals in phases after $6.3 billion hack

On November 1, 2026, at 06:00 UTC, Binance began reopening crypto withdrawals on its platform in stages. They had been halted since the hack of Thursday, October 29, 2026, in which roughly $6.3 billion was taken from the exchange's hot wallets, the largest crypto theft on record according to CoinDesk, Help Net Security and crypto.news. In its “Recovery Update #4”, published the same day, Binance announced that phase 1 of withdrawals would resume between 06:00 and 09:00 UTC.

Fifteen networks in the first phase

According to Binance's announcement, phase 1 covers the following network and asset pairs:

• BTC network: BTC;
• ETH network: ETH, USDT, USDC;
• BSC: BNB, USDT, USDC;
• TRX network: TRX, USDT;
• SOL network: SOL, USDT, USDC;
• XRP, ZEC, DOGE and SUI networks: each network's native asset;
• TON: USDT, GRAM;
• Polygon: POL, USDT, USDC;
• AVAX C-Chain: AVAX, USDT, USDC;
• Arbitrum: ETH, USDT, USDC, ARB;
• Base: ETH, USDC;
• Optimism: ETH, USDT, USDC.

The exchange says the reopening order follows user withdrawal demand over the previous week, and that each network-asset pair only goes live after security and stability checks. The Bitcoin network was the first to reopen, according to a Binance post on X reported by Cointelegraph, CNBC and crypto.news. CNBC, The Block and CoinDesk report that all fifteen phase 1 networks were available by 12:36 UTC. Other networks and assets will be added “once they are ready”, Binance says, without a timetable. Deposits remained open and were not affected by the incident, according to the exchange.

Binance reports $3.64 billion in net outflows

In the roughly nine and a half hours after the reopening, Binance says it processed $4.65 billion in withdrawals and $1.01 billion in deposits, or $3.64 billion in net outflows, according to the exchange's figures as reported by The Block, CNBC and Decrypt. That amount represents 2.1% of the platform's $171 billion in assets. The Block notes, however, that this total comes from the October 28 proof of reserves, which predates the hack. Binance says withdrawals spiked at first and then slowed. Founder Changpeng Zhao wrote on X that “98% choose to stay”, arguing that net outflows were limited to 2.1%.

Readings from the DefiLlama tracker on Binance wallets show higher 24-hour outflows: $4.05 billion late in the afternoon of November 1 according to The Block, $5.8 billion according to Cointelegraph, and more than $6 billion on November 2 according to CoinDesk. These figures may include internal transfers or movements to new hot wallets, so they do not measure client withdrawals alone.

95% coverage and a loss borne by the exchange

According to its fourth update, Binance now covers about 95% of the affected amount, up from 90% in the previous update and 80% in the one before. The remaining 5% consists of tokens outside the top ten, which are less liquid and which the exchange is still buying back on the market and over the counter (OTC). Binance states that balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are 100% covered and points to its proof of reserves snapshot. The exchange has committed to absorbing the loss itself, without passing it on to users, and will publish a post-incident report once the investigation is complete.

To rebuild the assets, Binance drew on its treasury, its SAFU fund (Secure Asset Fund for Users) and part of its futures insurance fund, according to CNBC, Cointelegraph and The Crypto Times. Close to $3 billion of the stolen funds, mostly stablecoins, has been frozen with the help of issuers such as Tether and Circle; Elliptic puts that figure at around $2.84 billion. In an alert issued on Saturday, October 31, and cited by Decrypt, BleepingComputer and Security Affairs, the FBI attributes the theft to North Korea through the TraderTraitor group, also tracked as Lazarus and APT38, and urges crypto firms to block addresses linked to the theft.

What it means for traders

For now, only the phase 1 network-asset pairs have been announced as available. For USDT or USDC withdrawals, the network selected at the time of the request would therefore be decisive: a request on an unlisted network might not go through. Binance warns that delays or longer processing times are possible at first because of traffic, and recommends that users whose withdrawal fails try again a little later and check availability on the asset's withdrawal page or on its network status page.

Since deposits were never suspended, an asset outside phase 1 deposited at this stage might not be withdrawable right away, given that no date has been set for the next phase. Holders of less liquid tokens, which make up the 5% still uncovered, would have reason to follow the exchange's upcoming updates and its next proof of reserves, whose publication date has not been confirmed. Futures traders might also keep an eye on the insurance fund, which has been partly drawn down.

On the market side, bitcoin traded around $77,700 to $77,900 on November 1 and 2, after a low of about $76,500 in the wake of the hack, according to CoinDesk and Cointelegraph. Bitcoin ETFs saw roughly $643 million in outflows over the same period. With heavy outflows in the background, leverage management would carry particular weight, especially on thinner altcoins. For Binance clients, the announcement page and the network status page would remain the reference points for tracking the next phases.