Dogecoin is among the assets in Binance's first withdrawal phase. Photo: Wikimedia Commons (CC BY-SA 4.0)
In 60 seconds: Binance reopens withdrawals in phases today, Sunday, Nov. 1, after the Oct. 29 hack of about $6.3 billion — phase one runs 06:00–09:00 UTC on 15 networks, with Binance saying about 95% of the stolen assets are replaced and full proof of reserves due Nov. 3.
- Phase one opens today, Nov. 1, between 06:00 and 09:00 UTC (1:00–4:00 AM ET) on 15 networks.
- The first wave covers major assets including BTC, ETH, BNB, SOL, XRP and DOGE.
- Binance says about 95% of the stolen assets are replaced, and top-10 balances are 100% backed.
- The catch: full cryptographic proof is not due until Nov. 3, and Binance warns of possible delays in the first window.
Here's the thing: for three days, Binance users have been able to see their balances but not move them. Today that starts to change — in stages, with warnings attached, and with the biggest questions still unanswered until Nov. 3.
Binance laid out the plan in its fourth security incident recovery update, posted on X late Saturday. Withdrawals return in phases rather than all at once, with further networks and assets opening gradually as security and stability checks are completed.
What happened
On Oct. 29, Binance was hit by an exploit that drained roughly $6.3 billion in cryptocurrency from its hot wallets — the largest crypto theft on record. The exchange halted withdrawals immediately to stop further losses, while deposits stayed open. We covered the original breach here, and the FBI's attribution here: the bureau said Saturday that North Korea's state-sponsored TraderTraitor unit was responsible.
Since then, Binance has been buying replacement tokens with company money rather than recovering the stolen funds. That distinction matters — "covered" does not mean "recovered" — and it's why today's reopening is a test of the exchange's claims, not just a return to normal.
Latest verified facts
Phase one starts today, Nov. 1, between 06:00 and 09:00 UTC (1:00–4:00 AM ET, just as US clocks fall back from daylight saving time). It covers 15 networks, including Bitcoin, Ethereum, BSC, Solana and Polygon. The first wave of assets named for withdrawal includes BTC, ETH, BNB, TRX, SOL, XRP, ZEC, DOGE, TON, POL, AVAX, ARB, BASE, OP and SUI.
| Phase one at a glance | What Binance says |
|---|---|
| Window | Nov. 1, 06:00–09:00 UTC (1:00–4:00 AM ET), 15 networks |
| Assets in first wave | BTC, ETH, BNB, TRX, SOL, XRP, ZEC, DOGE, TON, POL, AVAX, ARB, BASE, OP, SUI |
| Stolen assets replaced | About 95%, up from 90% a day earlier; the rest is less-liquid tokens outside the top ten |
| Balances 100% backed | BTC, ETH, USDT, USDC, BNB, SOL, XRP, USD1, RLUSD, ZEC |
| Still to come | Further phases for other networks and assets; full cryptographic proof of reserves due Nov. 3 |
Binance says it has now replaced about 95% of the stolen assets, up from 90% a day earlier, and that balances of BTC, ETH, USDT, USDC, BNB, SOL, XRP, USD1, RLUSD and ZEC are 100% backed. The remaining roughly 5% sits in less-liquid tokens outside the top ten, which take longer to source at scale. The exchange has published a proof-of-reserves snapshot; the full cryptographic proof, which lets users check their own balances are counted, is expected Nov. 3.
Two honest caveats belong in the same paragraph as those figures. Security firm CertiK has said it needs more information before it can verify Binance's claimed replacement holdings. And Binance itself warns that some users may face delays or failed withdrawals during the initial rollout — a slow withdrawal in a phased restart is normal, but it is not the same as a clean reopening.
Why it matters
Binance has pledged to absorb the full financial impact of the theft rather than pass losses to users, using its corporate treasury, part of its futures insurance fund and a partial deployment of SAFU, its emergency fund for users. It has committed to restoring SAFU to about $1 billion after the drawdown. If that holds, users keep their balances intact — and the exchange avoids the kind of confidence collapse that has killed smaller platforms after big hacks.
At the same time, roughly $3 billion of the stolen assets has been frozen by industry partners including Tether and Circle — a separate pool from the replacement tokens Binance bought. That coordination is a big part of why the damage, while historic in size, has not yet become a wider market panic.
Impact on the USA and the world
For American users, this is the practical question behind the headlines: can you actually get your money out, and when? Phase one answers that for the biggest assets first, but users holding smaller tokens are still waiting on later phases. For US regulators, the FBI's TraderTraitor attribution turns a corporate security failure into a national-security story about how a sanctioned regime funds itself through crypto theft.
Globally, today's window is the moment Binance's numbers meet its users. A smooth phased reopening would calm the market's worst fear — that a $6.3 billion hole can't be papered over. A jammed or disorderly one would do the opposite, fast. Either way, regulators everywhere are watching, and some are already tightening the rules — see Westpac's new $10,000 crypto transfer cap in Australia.
What happens next
Our take: watch what actually happens inside today's window, not just that it opened. The three things to track are whether withdrawals on the 15 networks process without long queues, whether Binance announces dates for the next phases, and what the full cryptographic proof of reserves shows on Nov. 3. That proof — not today's press updates — is the document that lets outsiders verify the 95% figure and the 100%-backing claim.
If phase one runs cleanly and the Nov. 3 proof holds up, Binance will have pulled off one of the fastest large-scale recoveries in crypto history. If either stumbles, the story flips back to doubt very quickly. Today's window is the first real evidence either way.
Frequently asked questions
When can I withdraw from Binance?
Phase one runs today, Nov. 1, between 06:00 and 09:00 UTC (1:00–4:00 AM ET) on 15 networks, covering major assets like BTC, ETH, BNB, SOL, XRP and DOGE. Other networks and assets follow in later phases.
Will I lose my funds because of the hack?
Binance says no — it will absorb the loss, not users. It says about 95% of the stolen assets are replaced and top-10 balances are 100% backed, but independent verification awaits the full proof of reserves due Nov. 3.
What should I watch next?
How today's first window actually performs, dates for the next phases, and the full cryptographic proof of reserves on Nov. 3.
Sources: CoinLab; BBX; The Economic Times; ForexCrunch; Binance's fourth security incident recovery update (via X); FBI attribution via prior Senate Wire coverage. Read our earlier coverage: Binance's $6.3 billion hack and the FBI's North Korea attribution.