Binance reopened Bitcoin withdrawals on Sunday, Nov. 1, becoming the first network to resume service after a $6.3 billion hack forced the exchange to pause operations. Founder Changpeng Zhao confirmed the resumption in a brief post on X, writing, "BTC withdrawal is live."

BTC withdrawal is live.
— CZ 🔶 BNB (@cz_binance) November 1, 2026

Bitcoin is the first network to come back online. Alongside the restart, the exchange said it has replaced roughly 95% of the assets stolen in the incident, up from the 80% reported in an earlier update and the 90% disclosed on Saturday. Withdrawal access is the most basic service an exchange provides, and its restoration gives customers a way to move funds off the platform for the first time since the Oct. 29 attack.

How Binance Is Covering the Losses

Binance said it has set aside more than $6.34 billion in company funds to cover the shortfall, including $5 billion denominated in the affected cryptocurrencies. That figure excludes roughly $3 billion in stolen assets frozen by partners such as Tether and Circle, which the exchange counted separately. Both are stablecoin issuers — Tether for USDT and Circle for USDC — with the technical ability to freeze tokens at flagged addresses.

The replacement effort draws on three sources: the corporate treasury, additional reserves from the futures insurance fund, and part of the Secure Asset Fund for Users, known as SAFU, an emergency reserve the exchange created in 2018 to absorb losses in a crisis. Binance said it plans to restore SAFU to approximately $1 billion.

Customer balances in Bitcoin, Ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, according to the exchange. The remaining 5% consists of less liquid tokens that take longer to purchase.

Co-CEO Richard Teng said the company would absorb the losses, and the exchange's update stressed that the cost falls on Binance, not its users.

Investigation and Proof of Reserves

The attack struck multiple hot wallets — internet-connected wallets that exchanges rely on to process customer withdrawals — on Thursday, Oct. 29. Blockchain analytics firms TRM Labs and Chainalysis have linked the incident to TraderTraitor, a North Korea-linked hacking group. TraderTraitor is the designation U.S. cybersecurity agencies apply to North Korean state-sponsored actors that target cryptocurrency companies.

Teng said investigators have identified additional breach points beyond a suspected compromised employee laptop. Binance has pledged to publish a detailed incident report once the investigation concludes.

The exchange also published a new proof-of-reserves snapshot taken on Oct. 31, with the full cryptographic proof of those holdings expected by Nov. 3. Proof of reserves is an attestation designed to let outside observers verify that an exchange's holdings cover customer balances. The cryptographic proof, the promised incident report and the still-unscheduled second phase of withdrawals are the next public checkpoints in the exchange's recovery.

Withdrawals Restart in Phases

The restart is proceeding in phases. The first covers selected cryptocurrencies across 15 blockchain networks, with an opening window set between 06:00 and 09:00 UTC on Sunday. The network list includes Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Zcash and Dogecoin, together with Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism, TON and Sui.

Engineers must complete security and stability checks for each asset-and-network pairing before a route opens, and inclusion on the list did not mean every route went live at once. Customers were advised to check the withdrawal page before sending transactions, and Binance warned that heavy traffic could cause delays.

No date has been announced for the second phase. Co-founder Yi He said the remaining wallets are undergoing repeated security audits, with other currencies to be prioritized by market value, funds held and number of users. Deposits remain open, and the company said updates will be communicated through its official channels.