Binance resumed withdrawals in phases on Sunday, November 1, days after a $6.3 billion hack froze customer access to funds on the world’s largest cryptocurrency exchange. Bitcoin withdrawals led the first phase, with the exchange saying it had replaced about 95% of the stolen assets using company money and that users would not bear the losses.
Withdrawal access matters because it is the first real test of whether customers can get their money back after the largest digital heist on record. Binance suspended withdrawals as a precaution while it assessed the attack, and the phased restart is designed to prove that the platform can reopen safely without triggering fresh failures.
Binance said the first withdrawal window ran between 06:00 and 09:00 UTC on Sunday, and that it posted on its status page shortly after 06:00 GMT that the planned withdrawals had begun. A Binance spokesperson told CoinDesk that restoring access to user funds was a priority and that the exchange was taking a controlled approach to reopen safely, monitoring closely as services returned in phases.
Withdrawal services resuming in phases
Phase one covers bitcoin and assets on 15 other blockchains, including ether, XRP and dogecoin, according to Reuters. Binance said the first batch of networks was led by bitcoin, with ether, USDT, USDC, BNB and XRP among the most requested assets prioritised for reopening. Additional networks and assets will follow only after each blockchain clears further security and stability checks, the exchange said.
Binance chose the order based on user demand data from the past week, so that each network and asset pair could be restored carefully rather than all at once. The exchange warned that users may face temporary delays or longer processing times during the initial rollout because of traffic volume, and advised anyone whose withdrawal did not go through to try again after a short while.
Deposits were not affected by the incident and remained open throughout, Binance said. The exchange added that it would share updates on further phases through its official X channel as each network cleared its checks.
95% of stolen assets covered
Binance said it had covered approximately 95% of the impacted amount, up from 90% in its previous update and about 80% before that. The exchange said it had covered about $6 billion of stolen cryptocurrencies by using company money to buy replacement tokens, drawing on a partial deployment of its $1 billion Secure Asset Fund for Users, known as SAFU, along with its futures insurance fund and corporate treasury.
Co-founder Yi He said on Saturday that 50% of SAFU funds would be used to cover hack losses, while the company committed to replenishing the fund to about $1 billion. Binance said the remaining 5% consisted of less liquid tokens outside its top ten listed assets, which take longer to source at the required scale through market and over-the-counter channels.
All balances in bitcoin, ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash are fully backed at 100%, the exchange said, pointing users to its proof-of-reserves snapshot. Binance said it took a proof-of-reserves snapshot on October 31, with a full zero-knowledge proof expected by November 3. “Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users,” the exchange said in its recovery update.
The hack struck on October 29, when attackers stole more than $6 billion in virtual assets from the exchange. Blockchain analytics firm TRM Labs said 18,270 bitcoin, worth about $1.47 billion, were among the stolen funds. Binance has said it worked with industry partners to freeze some of the affected assets, with about $3 billion located as of Friday, according to Reuters.
On Saturday, the US Federal Bureau of Investigation blamed North Korea for the theft, saying North Korean-linked actors were observed laundering the stolen assets by converting them into Ethereum. The FBI named the TraderTraitor group in its attribution, a finding reported in a separate SialNews post.
Binance said its work was not finished even as withdrawals resumed. “Resuming withdrawals is a major milestone, but our work continues. We will continue strengthening our safeguards, completing the recovery process, and providing updates as progress continues,” the spokesperson said. What remains uncertain is how quickly the remaining networks will reopen and whether the final 5% of less liquid tokens can be fully replaced without market disruption. For now, the phased restart gives customers their first access to funds since the hack, with the exchange promising that each further phase will depend on security checks, not on a fixed timetable.
