The first withdrawal phase was scheduled between 06:00 and 09:00 UTC on Sunday, covering 15 blockchain networks. Binance said additional withdrawals would become available only after the relevant networks and assets passed security and operational checks.
The restart follows the largest cryptocurrency theft on record, which began on October 29 when attackers compromised Binance hot wallets across multiple networks. Blockchain intelligence firm TRM Labs estimated the stolen assets at $6.36 billion.
Which Binance Withdrawals Are Available Again?
The initial reopening covers Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Zcash, Dogecoin, TON, Polygon, Avalanche, Arbitrum, Base, Optimism and Sui.
Supported assets include BTC, ETH, BNB, XRP, SOL, USDT and USDC, although availability varies by network. For example, USDT withdrawals are supported on Ethereum, BNB Smart Chain, Tron, Solana and several layer-2 networks during the first phase.
Binance said it prioritized networks according to recent customer withdrawal demand. Users may still encounter processing delays or unavailable withdrawal routes while the exchange progressively restores services.
The announcement advances Binance’s earlier commitment to restart withdrawals within 48 hours of its October 30 service update. Deposit services are operating normally, according to the exchange.
However, the reopening does not mean that every supported cryptocurrency or blockchain is immediately available to every customer. The exchange is directing users to its withdrawal interface and network status information to confirm which transfers have been enabled.
How Has Binance Replaced 95% of the Stolen Assets?
Binance said it has replenished approximately 95% of the assets affected by the breach, up from 90% in its previous update. At an estimated loss of $6.3 billion, that represents roughly $6 billion in replacement assets.
The exchange is using its Secure Asset Fund for Users, corporate treasury and other internal resources to cover the financial impact. It has committed to absorbing the losses rather than passing them on to customers.
Binance said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are now fully backed. The remaining 5% consists of less-liquid tokens that require additional purchases through market and over-the-counter channels.
Separately, Binance has reported approximately $3 billion in stolen assets identified or immobilized with assistance from industry partners. Stablecoin issuers have helped restrict access to substantial amounts of USDT and USDC, although these freezes are distinct from Binance’s replacement purchases.
Investor Takeaway
Binance’s asset replenishment reduces the reported customer shortfall, but restoring withdrawals and independently verifying reserve coverage remain separate tests.
What Did Investigators Find About the $6.3 Billion Hack?
TRM Labs traced approximately 18,270 BTC, 200,630 ETH, 1.875 billion USDT and 823 million USDC among the stolen assets. Additional losses involved XRP, Solana and several other networks.
Binance’s preliminary investigation linked the breach to a compromised DevOps engineer’s laptop, which allegedly allowed attackers to access infrastructure used to submit withdrawal transactions.
On October 31, the FBI formally attributed the attack to TraderTraitor, a North Korean state-sponsored hacking operation. Blockchain researchers had previously reached a similar conclusion based on on-chain activity and other intelligence.
Investigators identified rapid movements of stolen assets, including conversions into ether and transactions involving decentralized financial infrastructure. Earlier analysis of the TraderTraitor connection detailed how the attack resembled previous thefts associated with North Korean operators.
Can Binance Restore Confidence Without a Full Reserve Audit?
Binance has published a proof-of-reserves snapshot and says its major customer asset balances are fully backed. However, a reserve snapshot is not equivalent to a complete independent financial audit covering liabilities, operational controls and the financial impact of the incident.
The exchange has also promised a detailed post-incident report once its investigation concludes. That report could clarify how the attackers reached withdrawal infrastructure, what safeguards failed and which controls have since been strengthened.
Investor Takeaway
The immediate test is withdrawal reliability. Longer-term confidence will depend on verifiable reserves, completed asset replenishment and evidence that the exploited infrastructure has been secured.
With major withdrawal routes reopening, Binance has moved beyond the initial emergency shutdown. The remaining issues are whether less-liquid assets can be fully replaced, how much of the stolen cryptocurrency can be recovered and whether the exchange’s final investigation provides sufficient evidence that the vulnerabilities have been addressed.