Binance opens crypto withdrawals in phases starting with bitcoin following $6.3 billion hack

Binance is letting users access their coins days after the massive $6.3 billion hack, with bitcoin $BTC$77 914,26 payouts among the first services to be restored.

The exchange began the phased restart on Sunday, with the first withdrawal window running from 06:00 to 09:00 UTC.

“Binance is preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC). Restoring access to user funds is a priority, and we are taking a controlled approach to do so safely. We will continue to monitor closely as services return in phases,” a Binance spokesperson said in a statement shared with CoinDesk.

Alongside bitcoin, Binance reopened withdrawals for ether $ETH$2 268,17, $USDT $USDT$0.9993, $USDC $USDC$1,0002, $BNB $BNB$713,65, and $XRP ($XRP) with the most requested networks prioritized. Additional phases will follow, but only after each blockchain clears further security and stability checks.

The phased restart comes days after the hack, which occurred late Thursday and was the largest on record. Binance estimated the theft at about $6.3 billion in crypto, taken from its hot wallets, or the online wallets it uses for everyday payouts.

Blockchain analytics firm TRM Labs said 18,270 $BTC, worth about $1.47 billion, were stolen from Binance. It also identified 200,630 ether $ETH$2 268,17, 1.875 billion $USDT and 823 million $USDC stolen on Ethereum, along with 233.46 million $XRP, 970,500 $SOL and additional $USDT taken from other blockchains. $USDT and $USDC are stablecoins pegged to the U.S. dollar.

Blockchain analytics firms have attributed the exploit to TraderTraitor, a North Korean-linked entity.

With withdrawals resuming in stages, Binance said the pace depends on whether each blockchain passes its own security and stability checks.

“Resuming withdrawals is a major milestone, but our work continues. We will continue strengthening our safeguards, completing the recovery process, and providing updates as progress continues,” the spokesperson said.

The bigger concern for users is whether their funds are safe. Binance says they are.

The exchange said it has replaced about 95% of the affected assets, up from 90% a day earlier, using company funds. That includes its Secure Asset Fund for Users, an emergency reserve maintained for incidents such as this.

“All $BTC, $ETH, $USDT, $BNB, $SOL, $USDC, $XRP, USD1, RLUSD, and ZEC balances are fully backed 100%. Users can verify our proof of reserves snapshot on the PoR website,” the spokesperson said.