Binance reopens Bitcoin withdrawals first after $6.3 billion hack

Binance reopened Bitcoin (BTC) withdrawals early on Sunday, three days after thieves drained about $6.3 billion from its hot wallets. The resumption ran in a 06:00 to 09:00 UTC window on 1 November 2026, with Bitcoin the first network switched back on.

That schedule was Binance's own, set out in a recovery update on its announcements page. The company had frozen every withdrawal after the breach on 29 October, the largest crypto theft on record. By Sunday it said it had already replaced most of the missing coins with its own money.

Bitcoin first, then the rest in phases

Bitcoin led a first batch of 15 networks. Ether (ETH), BNB, XRP, Solana (SOL), USDT and USDC came back in the same wave, along with chains such as Tron, Polygon, Base, Arbitrum and Optimism. Binance said it set the order by the past week of customer demand, keeping each network shut until its own security and stability checks had passed.

Phase one was deliberately narrow. More networks will follow only as each clears its own review, and Binance gave no fixed date for the next round. Delays were likely in the meantime. The company warned of congestion, slower processing and short holdups while the backlog drained. Other firms caught up in the breach have been dealing with their own fallout since.

Binance suspended withdrawals after the breach and leaned on its official channels for updates while customers waited. The freeze lasted about three days. For most of that window, coins could not leave the platform. Sunday's phased reopening was the first clear sign that normal service was coming back, and the order of it, Bitcoin before anything else, tracked where customer demand was heaviest.

How much Binance says it has replaced

The numbers moved fast, and they are all Binance's own. On 31 October the exchange said it had covered about 90% of the affected assets. A day later it put the figure close to 95% in statements to CoinDesk and other outlets. Both counts come from the company, not an outside auditor.

Covered is not the same as recovered. None of that 95% was clawed back from the attacker. Binance topped up the missing balances from its Secure Asset Fund for Users, a slice of its futures insurance fund and its corporate treasury. "Binance will absorb the financial impact of these stolen funds, not our users," the company said.

About 10% is still outstanding. Binance said the gap sits in less liquid tokens outside its top 10, which take longer to buy in the volumes needed. It listed Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash as fully backed, and said it would keep buying until cover reached 100%.

The sheer size sets this apart. At about $6.3 billion, the theft is more than four times the roughly $1.5 billion taken from Bybit in February 2025, until now the largest exchange hack on record. A different order of magnitude. Both attacks have been tied to the same North Korea linked crews, which is part of why investigators moved quickly.

Who is blamed, and what is not clear

Late on 31 October, the FBI said North Korea was behind the theft. Agents found the attackers had started turning the haul into Ether to launder it, and expected more laundering to follow. Blockchain analytics firm TRM Labs had already named a North Korea linked group it calls TraderTraitor, and said the attack looked like the Bybit breach.

How the intruders got in is still contested. Binance first pointed to a compromised engineer's laptop that opened a path into one of its systems. Richard Teng, the exchange's co-chief executive, later said the method was more complex than the misuse of a single engineer's access. Binance has declined to say more while the inquiry runs.

Early loss estimates vary. TRM Labs put the haul at 18,270 Bitcoin, worth roughly $1.47 billion, plus large amounts of Ether, USDT, USDC, XRP and Solana. Binance's own $6.3 billion figure covers the full theft across all assets. Neither figure is final.

What to watch

A full proof of reserves check is the next marker. Binance published a snapshot alongside its 31 October update and, by some reports, expects a complete zero knowledge verification around 3 November. That report is the real test of whether customer balances are whole. A snapshot is not a finished audit.

Two promises are still open. Binance said it would rebuild its emergency fund toward about $1 billion once the buying is done, and publish a detailed incident report after the investigation closes. No date was set for either. For now the recovery is a staged reopening, measured in phases rather than hours.