Binance Restarts Crypto Withdrawals in Phases, Starting With Bitcoin, After Record $6.3 Billion Hack

Binance has begun letting users access their coins again, days after a record $6.3 billion hack, with bitcoin ($BTC, $77,914.26) payouts among the first services to be restored.

The exchange launched the phased restart on Sunday, with the first withdrawal window running from 06:00 to 09:00 UTC on Nov. 1.

"Binance is preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC). Restoring access to user funds is a priority, and we are taking a controlled approach to do so safely. We will continue to monitor closely as services return in phases," a Binance spokesperson said in a statement shared with CoinDesk.

Alongside bitcoin, Binance reopened withdrawals for ether ($ETH, $2,268.17), Tether ($USDT, $0.9993), USD Coin ($USDC, $1.0002), BNB ($BNB, $713.65), and XRP ($XRP), with the most requested networks prioritized. Additional phases will follow, but only after each blockchain clears further security and stability checks.

The phased restart comes days after the breach, which occurred late Thursday and was the largest crypto hack on record. Binance estimated the theft at about $6.3 billion in digital assets, taken from its hot wallets — the online wallets the exchange uses for everyday payouts. Because hot wallets stay connected to the internet to process day-to-day withdrawals, they are more exposed to online attackers than offline, or "cold," storage.

Blockchain analytics firm TRM Labs said 18,270 BTC, worth about $1.47 billion, were stolen from Binance. The firm also identified 200,630 ETH, 1.875 billion USDT, and 823 million USDC stolen on Ethereum, along with 233.46 million XRP, 970,500 SOL, and additional USDT taken from other blockchains. USDT and USDC are stablecoins pegged to the U.S. dollar.

Blockchain analytics firms have attributed the exploit to TraderTraitor, a North Korea-linked entity. TraderTraitor is the label analysts use for a cluster of North Korea-linked cyber activity aimed at cryptocurrency platforms, and attributions of this kind are typically built by tracing stolen funds on-chain.

With withdrawals resuming in stages, Binance said the pace depends on whether each blockchain passes its own security and stability checks. For users holding assets beyond the first phase, the sequence and timing of upcoming windows — announced as each network clears its checks — will determine when the remaining assets become accessible.

"Resuming withdrawals is a major milestone, but our work continues. We will continue strengthening our safeguards, completing the recovery process, and providing updates as progress continues," the spokesperson said.

For users, the bigger concern is whether their funds are safe. Binance says they are. The exchange said it has replaced about 95% of the affected assets, up from 90% a day earlier, using company funds. That includes its Secure Asset Fund for Users, an emergency reserve maintained for incidents such as this.

"All $BTC, $ETH, $USDT, $BNB, $SOL, $USDC, $XRP, USD1, RLUSD, and ZEC balances are fully backed 100%. Users can verify our proof of reserves snapshot on the PoR website," the spokesperson said. Proof of reserves is a published snapshot of an exchange's on-chain holdings, designed to let users independently check that customer balances are backed.