Binance withdrawals are live again, with 15 tokens open in phase one, including Ether, USDT and USDC. Customers started pulling money out on Sunday, more than two days after a hack the exchange puts at about $6.3 billion. The Bitcoin network went first.
Here is the tension. Binance says it has replaced about 90% of the affected assets, but that figure is its own claim, and no independent audit has confirmed it. For anyone holding coins on the exchange, the speed of withdrawals matters as much as the risk behind them.
The exchange is restoring withdrawals in phases, according to Bloomberg. Phase one opened around 2 p.m. Singapore time. Binance had frozen withdrawals after the Oct. 29 hack. For the full backstory, see our look at what the hack means for your crypto right now.
What reopened first as Binance resumes withdrawals
Binance says it chose the order based on how many customers tried to withdraw each coin over the prior week. In its own words, the “first batch network now opened in phase one of withdrawals is $BTC bitcoin network.” Later, CoinDesk reports that BTC, ETH, USDT, USDC, BNB and XRP were open.
The rest will come back slowly. Binance says it will “continue to restore additional assets and networks in phases as security checks are completed,” per CBS News. It also warned of congestion, longer processing times and temporary delays.
So if your withdrawal sits for a while, that is expected. Smaller networks may take longest.
Who pays for the hack behind the Binance withdrawal restart
Binance says it does. “Binance will absorb the financial impact of these stolen funds, not our users,” the company said in a statement quoted by CNBC. That is where the 90% replacement claim comes from.
The exchange has promised an updated proof of reserves once remediation is complete, but it has not published anything yet. We dug into that gap in our piece on whether Binance can really cover a $6.3 billion hack.
How the theft unfolded
Blockchain analytics firm TRM Labs says about $6.36 billion moved out of Binance wallets across ten blockchains on Oct. 29. Most of it left in roughly 20 minutes. That is about 20 minutes to empty the wallets, and more than two days to reopen the door.
Binance’s first finding pointed to a possibly compromised laptop belonging to a DevOps engineer. That gave attackers access to a service container and let them push through unauthorized withdrawals. Binance said it found no evidence of a leaked wallet private key.
That was only the initial finding. ABC News reports that Binance later found additional breach points but has not said what they were. The FBI said Saturday that North Korea was responsible, and reports name the TraderTraitor group. Binance had not confirmed the culprits itself in its early statements.
Here’s the thing: how fast people pull money out
The hack itself matters less than what customers do next. Binance holds roughly $135 billion in assets, versus about $29 billion at OKX, per DefiLlama figures cited by Investing.com. Fundstrat’s Sean Farrell told CNBC the hack does not appear to create meaningful solvency risk. The tell, he said, is how quickly withdrawals resume and whether the outflows stay orderly.
Still, questions remain. Binance says it has frozen about $3 billion on-chain, but whether anyone can recover that money is an open question. The totals also differ by source: TRM says $6.36 billion, Binance says about $6.3 billion, and Chainalysis put it near $6.4 billion. For another angle on the raid itself, read how one laptop led to a $6.3 billion loss.
The question the whole market is asking is simple. Does Binance get from 90% backing to 100% before customers lose patience?
