The exchange is restoring withdrawals in phases after a breach it says drained approximately $6.3 billion from its hot wallets
Binance is reopening withdrawals after a major security breach, and the first batch uses the Bitcoin network. That was the exchange’s short update as it began restoring access following an attack on October 29-30.
The scale explains the caution. Approximately $6.3 billion in digital assets was taken from Binance’s hot wallets, a figure that puts the incident on record as the largest exchange hack ever.
How the reopening works
Binance announced the phased resumption on November 1, 2026. Phase one went live between 06:00 and 09:00 UTC that day.
Bitcoin is not alone in the opening group. The BTC network reopened alongside 14 other networks, for 15 in total during this first phase.
Binance said it chose the order using recent user demand data. The networks people were most eager to withdraw from got priority.
Later phases are expected to follow, but only after additional security checks. Binance has not presented the full rollout as a single switch being flipped back on.
Deposits stayed open the entire time. Withdrawals were the only side of the ledger frozen, suspended immediately after the breach was detected.
The money question
The bigger issue for users is whether their balances are whole. Binance says they are.
The exchange reported replenishing about 90-95% of the stolen assets using company funds. That includes its Secure Asset Fund for Users, a reserve the exchange maintains for situations like this one.
Binance said users suffered no financial losses from the breach. In other words, the exchange is absorbing the hit on its own balance sheet rather than passing it to customers.
Some of the stolen funds also hit a wall. Around $3 billion of the assets were frozen by partner exchanges after the hack.
Binance has also scheduled a comprehensive proof-of-reserves update for November 2, 2026. Proof of reserves is a way for an exchange to show it actually holds the assets it owes customers, rather than just asking everyone to take its word.
Who is being blamed
The attack hit multiple blockchains. Ethereum and Bitcoin were the most heavily affected assets.
Blockchain analytics firms and the FBI have linked the breach to TraderTraitor, a group connected to North Korea. That attribution has kicked off extensive audits and security reviews inside Binance.
The multi-chain nature of the theft matters for the reopening plan. Every network involved needs its own review before withdrawals on it can safely resume, which helps explain why Binance is moving in batches.
What this means
For Binance users, the immediate takeaway is access. Bitcoin holders and those on the other 14 phase-one networks can move funds again, while everyone else waits for the next round of security checks.
The November 2 proof-of-reserves update is the next real test. A clean report would back up Binance’s claim that users lost nothing; any gap would invite harder questions.
Finally, the TraderTraitor attribution keeps the spotlight on state-linked hacking groups targeting crypto platforms. With roughly $3 billion frozen by partner exchanges, how much of the rest can be traced or recovered remains an open question worth watching.
