Binance expands phased withdrawals after $6.3 billion hack

Binance began reopening withdrawals for more assets on Nov. 3, five days after it said attackers had taken about $6.3 billion from its hot wallets in what appears to be crypto’s largest theft by dollar value. The exchange said the latest phase would start at 04:00 UTC and roll out asset by asset as security checks are completed, leaving the withdrawal service only partly restored. Binance’s Nov. 3 recovery update says deposits remain open; its earlier incident notice said other unaffected platform services also remained operational. The reported response was a withdrawal suspension, not a halt to all trading.

What is reopening, and what remains restricted?

Binance is restoring withdrawals in phases, with availability tied to individual asset and network combinations. The Nov. 3 list covers networks including BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, Tron and Base. Binance said it was prioritising tokens based on user demand over the previous week, and that each network and asset pair would reopen only after security and readiness checks. Temporary delays may continue during the rollout, and the exchange advises users to check availability for the specific asset and network they plan to use.

The phased approach trades speed for control: users regain access in stages while Binance checks affected services and monitors them as they return. It also means a general announcement that withdrawals have resumed does not guarantee that every asset can be moved. Binance said on Nov. 1 that its first phase included major assets such as BTC, ETH, USDT, USDC, BNB, SOL and XRP. The Nov. 3 update adds more assets and networks, but says further additions will follow as they become ready.

How does the loss compare with previous exchange hacks?

At about $6.3 billion, the reported loss is several times the $1.5 billion stolen from Bybit in February 2025, which had been described as the largest crypto exchange hack. The Associated Press reported that Binance’s attack involved funds moving across ten blockchains, with most transfers occurring in about 20 minutes, citing blockchain intelligence firm TRM. TRM and other firms have attributed the attack to North Korea-linked group TraderTraitor; Binance has said it is working with law enforcement to confirm who was responsible.

The comparison is about dollar value, not every measure of damage. Binance founder Changpeng Zhao told the AP that older incidents such as Mt. Gox’s affected more bitcoin, even though their dollar value at the time was lower. The incident also differs from a full platform shutdown: Binance said withdrawals were temporarily suspended while deposits and other unaffected services remained available. That preserved some access to the exchange while users could not freely move assets out.

What evidence will show whether recovery is holding?

Binance says it will bear the financial impact and cover the stolen funds through its Secure Asset Fund for Users and corporate treasury. In its Oct. 30 update, it said it had set aside more than $6.34 billion, including $5 billion in the same token assets affected by the theft, and reported that roughly $3 billion had been frozen on-chain. Those are company statements; the investigation and recovery process remain ongoing.

The next indicators are whether Binance completes the withdrawal rollout without further interruptions, publishes its promised technical post-incident report, and provides verifiable reserve information. Asset freezes and replenishment can limit direct losses to customers, but they do not by themselves explain how attackers gained access or show that the controls now in place will prevent a repeat. For users and other exchanges, the unresolved questions are the attack path, the amount ultimately recovered, and how quickly customers can move funds when a security incident forces a platform to restrict withdrawals.

Source material

• Nov. 3 recovery update — binance.com