Binance opens withdrawals in phases starting with bitcoin after $6.3 billion hack
Singapore, Nov. 2026 – Binance has reopened customer withdrawals following a record $6.3 billion exploit.
Binance is letting users access their coins days after the massive $6.3 billion hack with bitcoin BTC$77,882.69 payouts among the first services to be restored.
The exchange began the phased restart on Sunday, with the first withdrawal window running from 06:00 to 09:00 UTC.
“Binance is preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC).
“Restoring access to user funds is a priority, and we are taking a controlled approach to do so safely. We will continue to monitor closely as services return in phases,” a Binance spokesperson said in a statement shared with CoinDesk.
Alongside bitcoin, Binance reopened withdrawals for ether ETH$2,265.29, USDT USDT$0.9991, USDC USDC41.0001, BNB BNB$714.14, and XRP (XRP) with the most requested networks prioritized.
Additional phases will follow, but only after each blockchain clears further security and stability checks.
The phased restart comes days after the hack, which occurred late Thursday and was the largest on record. Binance estimated the theft at about $6.3 billion in crypto, taken from its hot wallets, or the online wallets it uses for everyday payouts.
Blockchain analytics firm TRM Labs said 18.270 BTC, worth about $1.47 billion, were stolen from Binance. It also identified 200,630 ether ETH$2,265.29, 1.875 billion USDT and 823 million USDC stolen on Ethereum, along with 233.46 million XRP, 970,500 SOL and additional USDT taken from other blockchains. USDT and USDC are stablecoins pegged to the U.S. dollar.
Blockchain analytics firms have attributed the exploit to trader Traitor, a North Korean-linked entity.
With withdrawals resuming in stages, Binance said the pace depends on whether each blockchain passes its own security and stability checks.
“Resuming withdrawals is a major milestone, but our work continues. We will continue strengthening our safeguards, completing the recovery process, and providing updates as progress continues,” the spokesperson said.
The bigger concern for users is whether their funds are safe. Binance says they are.
The exchange said it has replaced about 95% of the affected assets, up from 90% a day earlier, using company funds. That includes its Secure Asset Fund for Users, an emergency reserve maintained for incidents such as this.
“All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed 100%. Users can verify our proof of reserves snapshot on the PoR website,” the spokesperson said.
“Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update.
“The outstanding 5% are tokens outside the top ten listed above, and are less liquid in the market and take longer time to source at the required scale. We continue purchasing the remaining affected assets through market and OTC channels,” the spokesperson added.
Binance said users will not bear the loss. Instead, the exchange is absorbing the financial impact itself.
“Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users,” the spokesperson said.
Some of the stolen funds have also been frozen.
Binance said about $3 billion is currently immobilized, largely in stablecoins such as USDT and USDC, which their issuers can block.
Bitcoin and ether cannot be frozen in the same way.
Binance has also promised a full proof-of-reserves report, which is an audit-style report showing that an exchange holds the assets it owes customers, rather than asking them to take its word for it. (CoinDesK)
