Binance withdrawals resume in phases from Sunday, November 1, 2026, as the world's largest cryptocurrency exchange begins letting customers take money out again after a suspension that followed the theft of more than $6 billion in digital assets. In its November 1 update, Binance said it had now covered about 95% of the impacted amount, up from 90% in its previous update, and that the first batch of withdrawals would open on the Bitcoin network — the clearest sign yet that the exchange is moving from emergency containment to a staged reopening.

Key Points

• Binance said the first phase of withdrawals began on November 1, 2026, between 06:00 and 09:00 UTC, starting with the Bitcoin network.
• Coverage of the impacted amount has risen to about 95%, from 90% in the previous update and about 80% at first, Binance said.
• Ten assets — including Bitcoin, Ethereum, Tether, BNB and Solana — are now fully backed at 100%, the exchange said.
• The remaining 5% is in less liquid tokens outside those ten assets and will be sourced through market and over-the-counter purchases.
• A Proof of Reserves snapshot was taken on October 31, with the full zero-knowledge proof expected by November 3, Binance said.

What Happened

Binance said selected assets and networks would be made available progressively after security checks, rather than all at once. In a post on X, the exchange said: "First batch network is $BTC bitcoin network." Additional assets and networks will follow as they become ready, prioritised, Binance said, on the basis of user demand over the previous week.

The timetable matters because the first window fell in the middle of the day for much of Asia and in the early hours for the United States: 06:00 to 09:00 UTC is 11:30 a.m. to 2:30 p.m. in India and 12:00 p.m. to 3:00 p.m. in Bangladesh. Deposits had remained open during the suspension, Binance said, although it cautioned that withdrawals could face delays because of transaction volumes as customers return at the same time.

The exchange said withdrawals had been suspended as a precaution while it assessed the incident, secured the affected services and reviewed its withdrawal infrastructure. That framing — precaution, not a finding that customer funds were gone — has been central to Binance's messaging since the attack, and the phased reopening is its first practical test: if the first batches move smoothly, more networks follow; if queues build, the timetable stretches.

Background and Context

The theft took place on or around Thursday, October 29, 2026. The FBI said more than $6 billion in virtual assets was taken from Binance, and CoinDesk put the loss at about $6.4 billion, describing it as the largest theft in cryptocurrency history. Earlier reporting in this series put the drained total at about $6.36 billion moved across ten blockchain networks in roughly 20 minutes, and noted that Binance had set aside more than $6.34 billion in company funds to cover the losses.

On Saturday, October 31, the FBI gave the first official United States government attribution for the attack. It said North Korea's TraderTraitor hacking group was responsible, working with the Secret Service and the criminal investigation division of the Internal Revenue Service. The bureau said it had observed TraderTraitor actors converting the stolen assets primarily into Ethereum, and that it expected the funds to be laundered further through decentralised finance platforms and instant swap services. It listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address, and urged exchanges, DeFi services, blockchain analytics firms and other virtual asset providers to block transactions tied to them.

TraderTraitor is described by CoinDesk as a subunit of the Lazarus Group, the North Korean-linked hacking operation previously blamed for the $1.5 billion theft from the Bybit platform in February 2025. That precedent is why the laundering phase of this case is being watched as closely as the theft itself: a haul of this size cannot be moved quietly through a handful of wallets.

Binance Withdrawals Resume: What the 95% Figure Means

The jump from 90% to 95% is not a rounding change. Binance said it used a partial deployment of its Secure Asset Fund for Users, known as SAFU, a portion of its futures insurance fund and its corporate treasury to replenish the affected assets. The remaining 5%, it said, consists of less liquid tokens outside the ten assets it lists as fully backed. Those ten — Bitcoin, Ethereum, Tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD and Zcash — are, according to Binance, backed at 100%.

For customers, the distinction is practical. Holders of the ten fully backed assets are in the strongest position as withdrawals reopen in phases. Holders of the less liquid remainder depend on Binance completing market and over-the-counter purchases to close the gap, a process that takes longer precisely because thin markets cannot absorb large orders without moving prices. Binance has said it will fully cover the financial impact of the funds stolen, and the November 1 update is the latest instalment on that pledge, not its completion.

Stablecoin issuers had already frozen more than $2.4 billion of the stolen funds, according to CoinDesk, and earlier reporting put the total frozen on-chain with blockchain partners at about $3 billion. Freezes do not recover money by themselves — they stop it moving — but they shrink the pool the attackers can actually spend, and they give investigators a fixed set of addresses to watch.

Reactions and Quotes

Binance's own update was deliberately operational rather than triumphant: withdrawals in phases, security checks first, assets prioritised by demand, delays possible. Its X post naming Bitcoin as the first batch network was the only detail that pointed to a sequence, and it left the order of the remaining networks to be announced as each becomes ready.

The FBI's Saturday statement was the bluntest official language of the episode so far: "FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets."

Chainalysis chief executive Jonathan Levin warned that the address list published so far is only the beginning. The attackers have already used "thousands of addresses," he said, adding: "We anticipate this will become tens of thousands over the coming weeks as money is transferred through a broader money laundering network." He said the attackers have too much money for their trusted laundering venues to handle, so it will flow to a wider network of services, including bridges, instant exchanges and swappers, using what he called novel automated laundering mechanisms.

United States President Donald Trump, asked about the hack on Saturday by a White House reporter, said "we're learning about it" and that his administration would "talk to North Korea about it," according to CoinDesk. No further American action against North Korea over the theft had been announced at the time of the November 1 update.

Why It Matters

This is the largest cryptocurrency theft on record, and its handling will set expectations for every exchange that follows. A full, immediate reopening would have tested systems that had just been attacked; a prolonged freeze would have tested customer patience and, in some jurisdictions, regulators' patience too. The phased approach is a middle path, and its success will be judged in public, wallet by wallet, as each network comes back online.

The 95% figure also matters for trust in the SAFU model itself. Binance built the fund for exactly this kind of event, and deploying it alongside insurance and treasury money shows the fund working as designed — but only up to a point. The last 5%, in illiquid tokens, is where the model is hardest, and where customers will watch most closely for the promised market and over-the-counter purchases.

For the wider crypto market, the laundering battle is now the main event. Every address the FBI publishes, every freeze by a stablecoin issuer and every automated hop identified by Chainalysis narrows the attackers' options, but the sheer size of the haul means the trail is expected to widen before it narrows. That is why the FBI's warning was addressed not only to exchanges but to node operators, swap services and analytics firms: the defence has to be as distributed as the laundering.

What Happens Next

The next hard deadline is November 3, when Binance expects to publish the full zero-knowledge proof following its October 31 Proof of Reserves snapshot. That document will let independent observers check the exchange's backing claims without Binance revealing its full balance sheet, and it will be read closely after two successive coverage updates.

Before that, the phased rollout itself will produce the next news: which networks open next, whether delays materialise, and whether any batch has to be paused. Any pause would be significant, because it would suggest a security check found something the first phase did not. A smooth rollout, by contrast, would move attention back to the laundering investigation and to whether any further freezes are announced.

Longer term, the attribution to North Korea raises a diplomatic question that the November 1 update does not answer: whether the United States and its partners pursue sanctions, indictments or other action against the TraderTraitor network, as they have after previous North Korean-linked thefts. For now, the public record is the FBI's address list and its call for the private sector to block the funds.

Frequently Asked Questions

When did Binance withdrawals resume? Binance said the first phase began on November 1, 2026, between 06:00 and 09:00 UTC, starting with the Bitcoin network, with more assets and networks to follow progressively after security checks.

How much of the hack has Binance covered? About 95% of the impacted amount, according to its November 1 update, up from 90% previously and about 80% at first. The remaining 5% is in less liquid tokens outside ten fully backed assets.

Which assets are fully backed? Binance lists Bitcoin, Ethereum, Tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD and Zcash as fully backed at 100%.

Who does the FBI blame for the theft? North Korea's TraderTraitor group, in a Saturday, October 31 statement issued with the Secret Service and the IRS Criminal Investigation division. The FBI said the group was converting the stolen assets mainly into Ethereum.

When will Binance publish full proof of reserves? Binance said it took a Proof of Reserves snapshot on October 31, 2026, with the full zero-knowledge proof expected by November 3.

Related coverage: FBI blames North Korea for $6.3 billion Binance hack in record crypto heist, Binance covers 90% of $6.3 billion hack losses as withdrawals resume today and SpaceXAI Clean Air Act lawsuit survives as judge refuses to dismiss NAACP case.

Sources: Outlook Money, November 1, 2026; CoinDesk, October 31-November 1, 2026; FBI cyber advisory, October 31, 2026; Chainalysis statement via CoinDesk. The featured image is an illustrative photograph of a cryptocurrency trading room.