™Binance Reopens Withdrawals After $6.3 Billion Hack, Coin by Coin
The first phase covers 15 networks, and Binance says it has replaced 95% of the stolen crypto. The last 5% is in harder-to-buy tokens.
Binance customers pulled $4.6 billion off the exchange in the first nine and a half hours after it reopened withdrawals Sunday, the company said.
The world's best-known crypto exchange had frozen withdrawals after hackers took $6.3 billion worth of crypto from its wallets, TechCrunch reported. Between 6 a.m. and 3:30 p.m. UTC, $1.0 billion came back in as deposits. That left a net outflow of $3.6 billion, which Binance says is 2.1% of the assets it holds. The doors are open again, but only some of them.
This isn't a switch flipped back on. Binance's Nov. 1 recovery update lists 15 networks for phase one, each with specific coins attached. The company says it ranked them by how much users wanted them over the past week, and it'll add more networks and assets as they pass security checks.
Who waits longest comes down to what's in the account. Binance says it has replaced about 95% of the stolen amount, up from 90% in its previous update, by buying through market and over-the-counter channels. It says the missing 5% is tokens outside its top ten, which are harder to buy in bulk.
Those ten are BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Binance says balances in all of them are fully backed and points to a proof-of-reserves snapshot for anyone who wants to check. Binance hasn't said which of the other coins make up that 5%.
Getting money out, according to Binance's own instructions:
- Check the exact coin and network before sending. Pull up the withdrawal screen for that coin and the network you plan to use, or Binance's network status page; the company says either will show whether that pair is live.
- If a withdrawal fails, wait and try again. The company says failures on listed networks are expected during the rollout and that heavy traffic can slow processing.
- Check the reserves page if the coin is one of the ten Binance says are fully backed.
The easy mistake is assuming a coin is back everywhere because it's back somewhere. USDT is on the phase one list for nine networks, including ETH, BSC, TRX, SOL and TON. It isn't listed for Base, where only ETH and USDC made the cut. The list is a starting point, too: on Sunday morning, TechCrunch found Bitcoin and Ethereum withdrawals both still marked partially suspended on the status page.
The status page also cuts against one line in Binance's update. The update says deposits stayed open and were never affected by the incident. TechCrunch reported that Binance shut off money moving in either direction once the theft hit, and that Bitcoin deposits still showed as partially suspended Sunday.
The stolen coins aren't coming back on their own. The FBI named the thieves Saturday as TraderTraitor, a North Korean group the bureau said was swapping most of the haul into Ethereum and would likely keep laundering it, TechCrunch reported. Binance had already blamed North Korean hackers, and it says it'll publish a full incident report once its investigation is done.
Until then, customers have the company's word. Binance's update ends by promising that "these losses will not be passed on to users." At the bottom of the same page, Binance says it can, "in its sole discretion," amend or cancel the announcement at any time, without notice.
Source: TechCrunch, retrieved November 2, 2026. Other sources: binance.com, binance.com (2).
Comments 0