Binance has started turning withdrawals back on after the October 29 hot-wallet breach it puts at about $6.3 billion. The exchange said it was “preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC),” listed 15 networks for that first phase, and said it has now covered roughly 95% of the impacted amount, up from 90% in its previous update.
The plan was laid out in Binance’s fourth recovery update, published early on November 1. Withdrawals had been suspended since the attack, while deposits stayed open throughout. “Deposit services remain open and are not affected by the incident,” the exchange said.
What opens first
Phase one is limited to the busiest routes. Binance said it is “prioritizing tokens based on the past week data of user demand,” and its network table lists Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Zcash, Dogecoin, TON, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism and Sui. The listed assets will be “available for withdrawals progressively,” it said, with more networks added once they are ready.
Not every asset is available on every one of those networks. Stablecoins get the widest coverage: USDT is listed on nine of the 15 networks and USDC on eight. Arbitrum also includes ARB, TON includes GRAM, and Polygon includes POL. By our count the table adds up to 33 coin-and-network pairs.
Binance co-founder Yi He said the first batch “covers 15 currencies across the 15 networks shown in the chart” and that wallets for other currencies are still undergoing repeated security audits and perimeter checks. She said those would be prioritized based on market cap, locked funds and user base.
Co-CEO Richard Teng described the restart as “taking a careful approach to ensure services return safely and securely.” The exchange warned that users “may experience temporary delays or longer processing times due to traffic volume.”
A slow start on the live status page
Bitcoin went first. Shortly after the window opened, Binance said the “First batch network is $BTC bitcoin network.” The exchange publishes deposit and withdrawal status for every coin and network through a public endpoint, and AltcoinReporter has been checking it since the window opened. At 06:17 UTC, 17 minutes into the window, bitcoin on the Bitcoin network was still the only one of the 33 phase-one pairs showing withdrawals enabled. Across the whole exchange, that was one live withdrawal route out of 1,447 listed coin-and-network combinations.
That is not a sign of trouble on its own. Binance gave itself a three-hour window and said the phase-one assets would come online progressively, so a staggered switch-on is consistent with the announcement. It does mean users holding ETH, stablecoins or SOL should expect to wait longer than bitcoin holders, and should check the withdrawal page for their specific network before moving funds.
From 90% to 95% covered
The more consequential figure for customers is the coverage number. “Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update,” the exchange said. In its previous update the figure was 90%, and on October 30 it was about 80%.
Binance said balances in ten assets are “fully backed 100%”: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The missing 5% sits in tokens outside that group, which it described as “less liquid in the market” and slower to source “at the required scale.” It is still buying them “through market and OTC channels.”
The two lists do not line up exactly, so it pays to check your own holdings against both. USD1 and RLUSD are fully backed but are not in the first withdrawal table. DOGE, TRX, GRAM, POL, AVAX, ARB and SUI are slated for phase one but were not named among the fully backed assets. Binance has not given a per-token breakdown of the remaining shortfall.
The exchange repeated that customers will not carry the loss. “Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users,” it said. In its October 30 update it said about $3 billion of the stolen assets had been frozen on-chain, and on Sunday it separately thanked the FBI’s Cyber Branch, which has attributed the attack to North Korea’s TraderTraitor group.
What to watch next
The first test is whether all 33 phase-one routes are live by the end of the 09:00 UTC window, and whether processing times hold up once the backlog of requests from the past few days starts to clear.
After that, attention moves to the assets still locked. Binance has not published a date for phase two. Its third update said a full zero-knowledge proof of reserves, built from a snapshot taken at 00:00 UTC on October 31, is estimated to be ready by Tuesday, November 3, letting holders of the ten fully backed tokens verify that their assets are backed at least 1:1. The exchange has also promised a post-incident report once its investigation is complete, which should give more detail on how its hot wallets were compromised.
FAQ
Can I withdraw from Binance now? Only on some networks. Phase one covers 15 currencies on 15 networks, with Binance preparing to resume it between 06:00 and 09:00 UTC on November 1. At 06:17 UTC only bitcoin on the Bitcoin network showed as enabled, so check the status of your specific coin and network first.
Are deposits affected? No. Binance said deposits stayed open throughout the incident and were not affected.
Will users lose money from the hack? Binance says no. It has committed to covering the losses itself, says about 95% of the impacted amount has been covered, and says it is buying the rest.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
