Binance has begun restoring cryptocurrency withdrawals in phases after hackers stole approximately $6.3 billion worth of digital assets from the exchange, with the company saying it has replaced about 95% of the affected funds using its own financial resources.
The world’s largest cryptocurrency exchange by trading volume announced on Sunday, November 1, 2026, that the first phase of withdrawal services would cover 15 blockchain networks, including Bitcoin, Ethereum, BNB, Solana, XRP and Dogecoin.
In its fourth security incident recovery update published on November 1, Binance said the initial withdrawal rollout would begin between 06:00 and 09:00 UTC, with additional assets and networks to be restored progressively after security and operational checks.
The exchange warned that users could experience temporary delays or longer processing times during the initial rollout because of increased traffic.
Binance said it was prioritising assets based on withdrawal demand over the preceding week, while ensuring that individual networks and asset pairs met its security and stability requirements before reopening.
The restoration follows a security breach on October 29, when attackers compromised Binance’s hot wallets and stole approximately $6.3 billion in cryptocurrency.
In its October 30 security update, Binance said it had committed more than $6.34 billion in company funds to cover the losses, including assets held in the exact cryptocurrencies affected by the incident.
The exchange initially reported that it had covered approximately 80% of the affected amount before raising the figure to 90% and subsequently 95% in its November 1 update.
Binance said the remaining 5% consisted mainly of less liquid tokens outside its top 10 assets, which require more time to purchase in sufficient quantities through market and over-the-counter transactions.
The company also confirmed that balances in Bitcoin, Ethereum, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash were fully backed.
It said the financial impact of the theft would not be transferred to customers, adding that it was using its Secure Asset Fund for Users (SAFU), Futures Insurance Fund and corporate treasury to replenish the affected assets.
Binance also disclosed that approximately $3 billion of the stolen assets had been frozen on-chain through cooperation with law enforcement agencies, blockchain intelligence firms and other industry partners.
The Federal Bureau of Investigation (FBI) has attributed the attack to North Korea, identifying the state-linked hacking unit known as TraderTraitor as responsible for the theft.
In an October 31 statement, the FBI said the group stole more than $6 billion in virtual assets from Binance on or around October 29.
The agency said investigators had observed the attackers converting the stolen cryptocurrency primarily into Ethereum, with plans to move the assets through decentralised finance platforms and instant cryptocurrency swap services to conceal their origins.
The FBI urged cryptocurrency exchanges, blockchain infrastructure operators and decentralised finance platforms to identify and block transactions connected to the addresses associated with the hackers.
The phased reopening of withdrawals marks a significant step in Binance’s response to the incident, although the exchange said its investigation, asset recovery efforts and security reviews were continuing.
Binance also promised to publish a detailed post-incident report after the investigation is completed.
