What to Know
- Binance resumed withdrawals for bitcoin and assets on 15 other blockchains on Sunday after a $6.3 billion hack.
- The first withdrawal window ran from 06:00 to 09:00 UTC on 2026-11-01.
- Bitcoin payouts were among the first services restored, alongside ether, USDT, USDC, BNB and XRP on prioritized networks.
- Further reopening phases depend on each blockchain clearing security and stability checks.
- Binance says it has replaced about 95% of the stolen assets using company funds, up from 90% a day earlier.
- The exchange says all BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed 100%.
- Blockchain analytics firm TRM Labs said 18,270 BTC, worth about $1.47 billion, were stolen from Binance.
- Binance says about $3 billion of stolen funds is currently immobilized, largely in stablecoins such as USDT and USDC.
- Blockchain analytics firms have attributed the exploit to TraderTraitor, a North Korean-linked entity.
Binance Restores Access in Controlled Phases
Binance has reopened customer withdrawals in a staged process following a $6.3 billion exploit that disrupted access to user funds and placed one of the crypto market’s largest trading venues under intense scrutiny. The restart began with bitcoin and selected assets across 15 other blockchains, marking the first major step toward restoring normal operations after the record hack.
The exchange began the phased restart on Sunday, with the first withdrawal window running from 06:00 to 09:00 UTC on 2026-11-01. Binance said the controlled rollout was designed to return access to funds while limiting operational and security risks. The exchange also said additional reopening phases will depend on whether each network passes security and stability checks.
Bitcoin led the first phase of restored withdrawals, a notable choice because BTC remains one of the most widely held and closely watched assets on centralized exchanges. Binance also reopened withdrawals for ether, USDT, USDC, BNB and XRP, with the most requested networks prioritized. The staged approach means some users may see access return sooner than others, depending on the asset and blockchain involved.
Security Checks Remain Central to the Rollout
Binance’s decision to reopen withdrawals gradually reflects the operational complexity of restarting services after a large-scale breach. Exchanges rely on a mix of hot wallets, internal controls, liquidity sourcing, network integrations and monitoring systems to process withdrawals. When a major exploit occurs, reopening all services at once can create additional risk if security teams have not fully validated each pathway.
For that reason, the exchange has tied each new phase to security and stability reviews. In practical terms, that means individual blockchain networks, wallet routes and asset flows may be cleared at different speeds. Market participants typically watch these reopening phases closely because they provide clues about whether an exchange has regained control over its infrastructure and whether customers are comfortable moving assets again.
The incident occurred late Thursday and involved Binance’s hot wallets, which are online wallets used for everyday payouts. Hot wallets are necessary for fast withdrawals, but they are also a frequent focus for attackers because they must remain connected to exchange systems. The size of the Binance exploit has intensified debate over how major platforms balance liquidity, speed and security.
Scale of the Stolen Assets
Binance estimated the theft at about $6.3 billion in crypto. Blockchain analytics firm TRM Labs said 18,270 BTC, worth about $1.47 billion, were stolen from Binance. The firm also identified 200,630 ether, 1.875 billion USDT and 823 million USDC stolen on Ethereum, along with 233.46 million XRP, 970,500 SOL and additional USDT taken from other blockchains.
USDT and USDC are stablecoins pegged to the U.S. dollar, and their role in the exploit matters because stablecoin issuers can sometimes freeze tokens on-chain. Binance said about $3 billion is currently immobilized, largely in stablecoins such as USDT and USDC. Bitcoin and ether cannot be frozen in the same way, which can make recovery more difficult once those assets move beyond an exchange’s control.
Blockchain analytics firms have attributed the exploit to TraderTraitor, a North Korean-linked entity. Such attribution is significant but does not by itself guarantee rapid recovery. Stolen digital assets can be moved through numerous wallets, bridges, decentralized platforms and liquidity venues, requiring coordination between exchanges, issuers, investigators and law enforcement where applicable.
Binance Says Users Will Not Bear the Loss
The most immediate concern for customers is whether their balances remain safe. Binance says they are. The exchange said it has replaced about 95% of the affected assets, up from 90% a day earlier, using company funds. That replacement effort includes its Secure Asset Fund for Users, an emergency reserve maintained for incidents such as this.
Binance said all BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed 100%. The exchange also said users can verify balances through its proof of reserves snapshot. A proof of reserves process is intended to show that an exchange holds assets corresponding to customer liabilities, although market participants often examine the scope, timing and verification standards behind such disclosures.
The exchange said the outstanding 5% consists of tokens outside the top ten assets it listed. Binance described those tokens as less liquid in the market and said they take longer to source at the required scale. The exchange said it continues purchasing the remaining affected assets through market and over-the-counter channels.
Binance also said users will not absorb the financial impact of the stolen funds. Instead, the exchange says it will bear the losses itself. That commitment is important for customer confidence because large exchange hacks can trigger fears about withdrawal freezes, balance haircuts or delayed redemptions. By using company funds and emergency reserves, Binance is attempting to ring-fence users from the direct cost of the breach.
Why Bitcoin Withdrawals Matter First
The early restoration of bitcoin withdrawals carries symbolic and practical weight. Bitcoin is often viewed as the benchmark asset for exchange solvency and liquidity because of its deep market presence and broad user base. When an exchange restores BTC withdrawals after a crisis, traders often see it as one of the clearest signals that core payout infrastructure is returning.
That does not mean risk has disappeared. The reopening remains phased, and further services are still contingent on security and stability checks. Technical traders and exchange users may continue monitoring withdrawal queues, confirmation times, wallet movements and official reserve updates for signs that the recovery remains on track.
Bitcoin was trading at $77,967.90 in the market data cited during the reopening, while ether was listed at $2,268.64, USDT at $0.9993, USDC at $1.0002 and BNB at $713.31. Those prices provide context for the size of the affected assets and the operational stakes behind the restart, especially given the scale of BTC, stablecoins and other tokens identified in the exploit.
Proof of Reserves Moves Into Focus
Binance has promised a full proof-of-reserves report as part of the recovery process. In the exchange business, proof of reserves is designed to give customers and market observers visibility into whether a platform holds the assets it owes. After a major hack, that transparency becomes more important because users want more than assurances that balances are intact.
A full proof-of-reserves update may help clarify the exchange’s post-exploit asset position, including how company funds and emergency reserves were used to replace stolen assets. Still, market participants often look for more than reserve snapshots. They may also consider liability coverage, wallet segregation, independent verification and whether a platform can maintain orderly withdrawals under stress.
The phased withdrawal restart is therefore only one part of a broader credibility test. Binance must continue reopening services, sourcing remaining affected assets, strengthening safeguards and communicating clearly with users. In a market where exchange trust can shift quickly, the combination of withdrawal functionality and transparent reserves may determine how rapidly confidence stabilizes.
Market Impact and User Confidence
The Binance incident lands at a sensitive moment for crypto infrastructure, where users have grown more attentive to exchange risk, wallet security and reserve transparency. Large centralized platforms remain essential for liquidity, trading and fiat access, but they also concentrate operational risk. A record exploit at a major venue can affect sentiment beyond the immediate customers involved.
For bitcoin holders, the key issue is whether withdrawals continue functioning as additional phases open. For stablecoin users, the immobilization of about $3 billion in stolen funds highlights the different recovery tools available for tokens such as USDT and USDC. For XRP and other asset holders, the timing of restored access may depend on both network-level checks and the exchange’s remaining liquidity sourcing.
Binance’s next updates will be closely watched because the exchange has framed the restart as a continuing process rather than a completed recovery. The first withdrawal phase is a major milestone, but the broader test is whether all affected assets can be fully restored, whether the outstanding 5% can be sourced, and whether proof-of-reserves disclosures satisfy users seeking confirmation that balances remain backed.
Frequently Asked Questions (FAQs)
What did Binance reopen after the hack?
Binance reopened customer withdrawals in phases, beginning with bitcoin and selected assets across 15 other blockchains. Ether, USDT, USDC, BNB and XRP were also included in the first restored services on prioritized networks.
When did the first Binance withdrawal phase begin?
The first withdrawal window ran from 06:00 to 09:00 UTC on 2026-11-01. Binance said additional phases will follow only after security and stability checks are completed for each blockchain.
How large was the Binance exploit?
Binance estimated the exploit at about $6.3 billion in crypto. The theft occurred from hot wallets, which are online wallets used by exchanges for everyday payouts and customer withdrawal processing.
How much bitcoin was stolen from Binance?
Blockchain analytics firm TRM Labs said 18,270 BTC, worth about $1.47 billion, were stolen from Binance. Bitcoin cannot be frozen in the same way as some stablecoins, which can make recovery more challenging.
Are Binance customer balances fully backed?
Binance says all BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed 100%. The exchange also says users can verify its proof of reserves snapshot.
How much of the stolen amount has Binance covered?
Binance says it has covered approximately 95% of the impacted amount, up from 90% in its prior update. The exchange says the remaining 5% involves less liquid tokens outside the top ten assets it listed.
Will Binance users have to absorb the losses?
Binance says users will not bear the financial impact of the stolen funds. The exchange says it is absorbing the losses using company funds, including its Secure Asset Fund for Users.
How much of the stolen crypto has been frozen?
Binance says about $3 billion is currently immobilized, largely in stablecoins such as USDT and USDC. Stablecoin issuers can block certain tokens, while bitcoin and ether cannot be frozen in the same way.
Who has been linked to the Binance hack?
Blockchain analytics firms have attributed the exploit to TraderTraitor, a North Korean-linked entity. Attribution can help investigations, but asset recovery still depends on tracing, freezing and sourcing affected funds.
