Binance began restoring cryptocurrency withdrawals on Sunday, November 1, after a $6.3 billion hot-wallet theft forced the exchange to halt outgoing transfers for security checks. Bitcoin was the first network to reopen as the company started a wider, network-by-network restart, while announcing that it had replaced approximately 95% of the affected token assets with company resources.
The withdrawal restart marks a change in customers’ ability to access their coins. It does not mean every network is available, that the stolen assets have been recovered, or that Binance’s latest proof-of-reserves verification is complete. Those are three separate measures of progress following the October 29 attack.
Binance scheduled the first reopening window for 06:00–09:00 UTC on November 1. In its official recovery update, it identified 15 blockchain networks for the initial phase and warned that specific asset-network combinations would become available progressively, after security and stability checks. The exchange said deposits had remained operational throughout the suspension.
Which Binance withdrawals are reopening first?
Bitcoin withdrawals on the native BTC network were among the first services confirmed to have resumed. Binance’s initial rollout also listed ETH and stablecoins on Ethereum; BNB, USDT and USDC on BNB Smart Chain; TRX and USDT on Tron; SOL, USDT and USDC on Solana; and XRP on its own network. Other first-phase networks include Zcash, Dogecoin, TON, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism and Sui.
Listing an asset does not mean withdrawals on every chain supporting that asset are live. USDT, for example, may be accessible on one network and remain unavailable on another. Binance said the opening order reflects actual withdrawal demand over the previous week, with each token-network pair undergoing its own checks. Additional networks and assets will follow, but the company did not give a universal completion deadline.
Customers may encounter longer processing times or intermittent failures while the system handles pent-up demand. A failed request during the rollout is not, by itself, evidence of a fresh hack or of missing customer balances. Users must check the status of the specific asset and network in the withdrawal interface, rather than treating an announcement about Bitcoin as confirmation that all withdrawal options have resumed.
The pause had consequences beyond the global platform. Binance TH suspended cryptocurrency withdrawals on October 30 despite describing its own client assets as segregated from the international exchange. That was a separate entity’s precautionary measure; Sunday’s global Binance announcement does not, on its own, establish that the Thai operator has lifted its restrictions.
What does the 95% replacement figure actually cover?
Binance says it has sourced replacement assets for approximately 95% of the cryptocurrencies lost in the breach, an increase from the 90% reported on October 31 and 80% in its initial recovery announcement. The platform has said it is using a combination of its own corporate treasury, part of its Secure Asset Fund for Users (SAFU) and part of the Futures Insurance Fund, rather than passing the loss through to customer balances.
The pace of replenishment matters more than a dollar-value pledge alone because customer liabilities are denominated in specific tokens. A business holding sufficient dollars to cover a missing coin still needs to buy that coin, at market prices and in adequate quantities, before it can match the obligation in kind. Binance says ten major assets — BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC — already have 100% reserve backing.
The outstanding approximately 5% consists of other, less-liquid assets, which Binance continues to buy through public markets and over-the-counter counterparties. It did not say all remaining purchases were complete on November 1. Nor is the 95% figure a percentage of stolen tokens already returned by investigators; it refers to company-funded replacement of affected assets.
The distinction updates DaveFinances’ October 31 crypto roundup, which reported 90% replacement and a pending withdrawal restart. The new development is that withdrawals have started opening and the reported replacement ratio has advanced by another five percentage points.
Binance separately reported that about $3 billion in stolen assets had been frozen through coordination with token issuers, exchanges and investigators. An address freeze or immobilization is not the same as cash returned to Binance. The frozen amount must not be added to the 95% replenishment figure as if it were an additional pool of already spendable customer reserves. The company has said it will continue tracing and seeking recovery while absorbing the original shortfall itself.
Why is the full proof of reserves still outstanding?
Binance took a new proof-of-reserves snapshot at 00:00 UTC on October 31 and updated its public reserve information. However, the associated zero-knowledge cryptographic proof requires more processing time. The exchange said it expects the full proof to be ready on November 3. At this stage, customers are being given the company’s reported asset-backing figures alongside a planned independently checkable cryptographic record.
A reserve snapshot tests a narrower question than whether an entire business is solvent. It can help a user verify that the platform included the user’s reported balance and held sufficient corresponding on-chain assets at a particular moment. It does not automatically prove the absence of off-chain liabilities, undisclosed loans, legal claims or future liquidity bottlenecks. Equally, a 100% reserve ratio does not ensure instant withdrawals if a network is disabled for operational or security reasons.
Those distinctions were examined in DaveFinances’ analysis of Binance’s custody framework, SAFU and proof-of-reserves limitations. The current incident offers a particularly stark illustration: an exchange can pledge to make users whole, restore token backing and still require time to restore the systems that move customer assets off-platform.
For affected customers, the key next check is the published November 3 proof, including whether each eligible balance is incorporated and supported by a corresponding asset-liability calculation. Binance has also said newly generated reserve wallet addresses will be used for withdrawal transactions as part of its security response. Publishing wallet addresses or a snapshot, however, does not replace the promised technical explanation of how the original breach occurred.
How much was stolen, and who is suspected of the attack?
Binance said its hot-wallet infrastructure was compromised at approximately 20:05 UTC on October 29, causing about $6.3 billion in unauthorized outflows. Blockchain-investigation firm TRM Labs estimated the incident at $6.36 billion across ten blockchains, with most transfers completed in roughly 20 minutes. Its reconstruction included 18,270 BTC, about 200,630 ETH, substantial holdings of USDT and USDC, XRP and SOL. Those amounts are components of the same attack, not separate losses to add to the headline total.
On October 31, the FBI publicly attributed the theft to North Korea-linked TraderTraitor actors. The agency said investigators were observing movement and conversions of stolen assets into ETH and urged cryptocurrency services to help identify and interrupt subsequent laundering. That is a law-enforcement attribution; it is not a final judicial determination about the identity of every person involved.
The preliminary technical explanations have also evolved. Binance initially mentioned a potentially compromised laptop and later said investigators had identified additional points of intrusion. In its October 30 disclosure, the company said it had not found evidence that wallet private keys were leaked. That statement does not prove the keys were never exposed, nor does the FBI’s attribution establish the complete path used to compromise signing or withdrawal infrastructure. Binance has promised a fuller incident report.
The difference between freezing stolen stablecoins and recovering BTC or ETH is also relevant. Centralized stablecoin issuers may be able to prevent transfers of certain tokens, while native Bitcoin and Ether lack an equivalent issuer-level freeze switch. Neither the total frozen value nor a tracing firm’s identification of wallets guarantees that investigators can ultimately recover the assets.
As the first phase of withdrawals proceeds, three facts will reveal more than reassurance alone: whether additional asset-network combinations consistently reopen, whether customers can complete withdrawals without prolonged processing problems, and whether the scheduled reserve proof supports the company’s claims. Binance’s reported 95% replacement and operational restart represent substantial progress. They do not yet close the security investigation or complete the recovery process.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574