Binance to Resume Withdrawals in Phases After Covering 95% of $6.3 Billion Theft

Binance said it will resume withdrawals in phases on Sunday, starting with a three-hour window, after covering ninety-five percent of the $6.3 billion stolen on Thursday.

Phase one is scheduled to run from 06:00 to 09:00 UTC on Sunday. That is 01:00 to 04:00 Eastern Standard Time, after daylight saving time ended overnight in the United States. Deposits have stayed open throughout and are unaffected, Binance said. Withdrawals have been halted since the theft on Thursday, October 29.

A reopening in stages, not all at once

The first batch covers fifteen networks, including Bitcoin, Ethereum, BNB Chain, Solana and Polygon. The named assets include bitcoin, ether, BNB, Tron, Solana, XRP, Zcash, dogecoin, Toncoin, Polygon, Avalanche, Arbitrum, Base, Optimism and Sui. Binance said it chose the order using user demand data from the past week.

Each later network and asset is to open only after security and stability checks, Binance said. Other networks and assets will be restored one by one once they are ready. The exchange warned that heavy early traffic may cause delays or failed requests. It advised customers whose withdrawal fails to try again later.

The recovery claim behind the reopening

Binance said it has now covered ninety-five percent of the stolen assets, up from ninety percent a day earlier. The remaining five percent sits in less liquid tokens outside the top ten. Binance said those tokens take longer to source in the required amounts. It said it, not its customers, will absorb the loss.

The exchange said balances in ten assets are now fully backed. It named bitcoin, ether, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash. Binance published a proof-of-reserves snapshot alongside the update. A snapshot is a dated record of reserve holdings. The full proof behind it is still being generated, Binance said.

The replenishment drew on company funds and on portions of two reserve pools. One is the Secure Asset Fund for Users, an emergency fund for users. The other is the Futures Insurance Fund, which covers derivatives losses. Binance said it will restore the user fund to about one billion dollars after the draw.

Investigators name a North Korean unit

The Federal Bureau of Investigation said on Saturday that North Korea was responsible for the theft. It put the amount at more than six billion dollars in virtual assets taken on or about October 29. The bureau named the activity TraderTraitor, a state-sponsored North Korean unit. It worked with the Secret Service and federal tax investigators.

Investigators said they observed the actors converting stolen assets mainly into ethereum. The bureau said it expects further laundering through decentralized finance and instant swap services. It urged node operators, exchanges and analytics firms to block transactions tied to listed addresses. Pyongyang has denied using state-linked cyber units for espionage and theft. Its Geneva mission and China embassy did not respond to requests for comment.

The reopening follows the theft TickerGrove reported on Thursday. Attackers drained an estimated six point three billion dollars from Binance hot wallets in about twenty minutes. The method involved an EIP-7702 delegation, an Ethereum feature letting a wallet delegate execution. Chainalysis confirmed at least $5.912 billion stolen by Thursday evening.

What the reopening does not prove

Every recovery figure in this story is Binance's own report, not an independent verification. The exchange said the full zero-knowledge proof of reserves is expected on Tuesday, November 3. Generating that proof takes about forty to fifty hours, it said. Until it publishes, the October 31 snapshot is the latest reserve record available.

Outside verification is thinner still. The security firm CertiK said it needs more information to verify the claimed five billion dollars in replacement holdings. About three billion dollars frozen by partners, including Tether and Circle, is a separate pool. Frozen assets are immobilized, not recovered, and they do not by themselves prove customer backing.

What remains unknown

What remains unknown starts with whether phase one works as scheduled. Binance has not said when the remaining networks and less liquid tokens will open. It has not identified every token still being sourced. Whether the November 3 proof matches the exchange's claims is also unknown. No independent party has yet verified the replenishment figures.

The tests that come next

The first test is whether phase one completes inside its three-hour window without widespread failures. Later phases for the remaining networks and tokens will show how fast the reopening really moves. The November 3 proof of reserves is the next dated check. Independent verification, if it comes, will matter more than another company update.