Withdrawals Reopen at Binance After the $6.3 Billion Hack — In Careful, Watched Stages

 

Withdrawals Reopen at Binance After the $6.3 Billion Hack — In Careful, Watched Stages

Binance reopened Bitcoin withdrawals on Sunday, 1 November, becoming the first network to resume service after the exchange suspended withdrawals following the $6.3 billion cryptocurrency hack on 29 October. The first recovery phase went live between 06:00 and 09:00 UTC on Sunday, covering selected cryptocurrencies across 15 blockchain networks, with other withdrawals awaiting further security checks. Founder Changpeng Zhao confirmed the reopening in a short post on X, writing, "BTC withdrawal is live." The reopening was the moment at which Binance's assurances since Thursday — that user funds were safe, that the exchange would absorb the loss, and that access would return — met their first practical test, as customers who had been unable to move funds for two days tried to withdraw again.

The first phase was deliberately partial, and Binance was explicit that inclusion on the list did not mean every route opened at once. Alongside the Bitcoin network, the initial list comprised Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Zcash, Dogecoin, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism, TON and Sui. Several networks support withdrawals of multiple assets: Ethereum, for example, includes ETH, USDT and USDC, while Arbitrum supports ETH, USDT, USDC and ARB. Binance said it had arranged the reopening order using withdrawal demand recorded during the previous week, and that its engineers had to complete security and stability checks before enabling each supported asset and network combination. Customers were advised to check the withdrawal page or network status before submitting transactions, and the exchange warned that increased traffic could temporarily delay withdrawals during the rollout. Deposits had remained operational throughout the suspension; withdrawals were the only side of the ledger frozen, suspended immediately after the breach was detected.

Behind the reopening stood a larger claim about the money. Binance said on Sunday that it had replenished approximately 95 per cent of the affected assets, up from 90 per cent in its 31 October update and 80 per cent the day before. Co-chief executive Richard Teng confirmed the figure, writing, "We've now replenished approximately 95% of the impacted assets," and repeating that Binance would absorb the financial impact of the breach. The exchange has reserved more than $6.34 billion of company resources to cover the stolen assets, and said the balances of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were now fully backed. The recovery draws on the Secure Asset Fund for Users, known as SAFU, on excess reserves from the Futures Insurance Fund and on the company's corporate treasury. The remaining 5 per cent consists of cryptocurrencies outside the ten fully backed assets, which Binance said had lower liquidity and required more time to purchase in sufficient quantities, through exchanges and over-the-counter trading desks.

Proof of those claims is still to come in full. Before withdrawals reopened, Binance had taken another proof-of-reserves snapshot at 00:00 UTC on 31 October, which it said was available on its proof-of-reserves website, showing the ten named balances fully backed. The complete zero-knowledge cryptographic proof, however, requires additional processing, and Binance expects that verification to become available by Tuesday, 3 November. The company has also committed to restoring its SAFU emergency reserve to around $1 billion after deploying part of the fund during the recovery, a commitment that matters because SAFU is the reserve meant to protect users in an extreme event, and it is thinner while the recovery continues. Until the full cryptographic proof is published, the replenishment figures remain Binance's own self-report, a point outside analysts have already raised: security firm CertiK has said it needs more information to verify the claimed replacement holdings, according to reporting of its position.

How the theft happened is still only partly explained, and the explanation has widened as the investigation has progressed. Binance's preliminary findings pointed to a potentially compromised employee laptop, described in later reporting as belonging to a DevOps engineer, which may have allowed the attackers to access its systems and initiate unauthorised withdrawals through a service container; the company later said subsequent investigations had uncovered additional points of breach, and that the laptop was not the only factor. Technical investigations identified malicious Ethereum wallet authorisations, and the company said it had found no evidence that wallet private keys were leaked, had revoked the authorisations of affected addresses, and had carried out a complete security revamp of the withdrawal service. Attribution has come from blockchain analysts rather than from Binance or law enforcement: blockchain analytics firms and the FBI have linked the breach to TraderTraitor, a group connected to North Korea, according to TradingView's reporting of the firms' findings. Binance has pledged to publish a detailed incident report after its investigation concludes, and a fuller technical account was expected within about 48 hours of its second update.

What happens next will be decided in stages, and Binance has given no fixed timetable for the second recovery phase. Co-founder Yi He said the remaining wallets were undergoing repeated security audits and checks of their protective systems, and that additional currencies would be prioritised according to market capitalisation, funds held and the number of customers using each asset. If the first phase holds — withdrawals processing without delay or fresh security alarms, and the proof of reserves on 3 November confirming the snapshot — Binance will have contained the immediate crisis of the largest cryptocurrency theft on record, more than four times the $1.5 billion stolen from Bybit in February 2025. If the rollout stalls, or if the reserves verification raises new questions, the exchange will face the test of confidence that no replenishment percentage can settle on its own. Either way, the hack has already forced other exchanges to tighten their security, and the post-mortem, when it comes, will have to answer the question that has hung over the incident since Thursday: how a breach that began, on the company's own preliminary account, with a single compromised laptop could drain $6.3 billion in about twenty minutes.

Sources:

- crypto.news — https://crypto.news/binance-reopens-bitcoin-withdrawals-after-hack/

- TradingView News, reporting Crypto Briefing — https://www.tradingview.com/news/cryptobriefing:4612c0620094b:0-binance-picks-bitcoin-network-for-first-batch-of-withdrawal-reopenings-after-hack/

- Forex Crunch — https://www.forexcrunch.com/blog/2026/11/01/binance-reopens-withdrawals-sunday-with-90-of-stolen-crypto-replenished/

- CryptoDnes — https://cryptodnes.bg/en/inside-binances-war-chest-how-a-6-3b-hack-gets-absorbed-without-touching-user-balances/

Read the original on The Curtain: https://thecurtain.online/story/binance-withdrawals-reopen-after-6-billion-hack