Binance Resumes Bitcoin Withdrawals as Phased Restart Begins

Binance resumed bitcoin withdrawals on Sunday after covering ninety-five percent of the six point three billion dollars stolen on Thursday.

The restart began shortly after 0600 GMT, Binance said on its status page. Bitcoin is the only asset confirmed as resumed in the report. Fifteen assets sit in the first phase, among them ether, XRP and dogecoin. The other assets would follow in phases, the exchange said.

A restart in phases, bitcoin first

Phase one went live in a window from 06:00 to 09:00 UTC on Sunday, CryptoBriefing reported. It said deposits stayed open throughout the halt. Binance said it chose the order using recent user demand data. Later phases follow only after more security checks, the exchange said.

Withdrawals had been halted since the theft late on Thursday, October 29. Balances in ten major assets were already fully backed, Binance said in earlier updates. It named bitcoin, ether, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash. Those balances are separate from the phased network openings.

How Binance says it paid for the recovery

Binance said it covered ninety-five percent of the stolen tokens. It covered six billion dollars by using company money to buy replacement tokens. The remaining five percent sits in less liquid assets. Binance said those assets may take longer to source in the required amounts.

The exchange set aside around six point three four billion dollars of company funds internally to cover losses. Replacement purchases came from the Secure Asset Fund for Users, an emergency customer reserve known as SAFU. Money also came from its Futures Insurance Fund and its corporate treasury, Binance said.

Co-chief executive Yi He said on Saturday that fifty percent of SAFU funds would be used. Binance committed to replenishing SAFU to about one billion dollars, she said. The exchange said it is working with industry partners to freeze affected assets. About three billion dollars had been located as of Friday, it said.

Two accounts of who did it

The Federal Bureau of Investigation said on Saturday that a North Korean unit was responsible. It named TraderTraitor, a state-sponsored North Korean unit. Law enforcement observed members converting stolen assets into ether, the bureau said. It said it expected further laundering of the assets.

President Donald Trump gave a different account on Saturday. He said the United States was still not certain whether North Korea was involved. "We don't know if it's North Korea," he said, in comments posted by a White House handle on X. He added that if it was, the United States would talk to North Korea about it.

Co-chief executive Richard Teng called the breach a "complex attack." He said it involved a compromised laptop and malware designed to delete evidence. The bulk of the theft unfolded in around twenty minutes late on Thursday. Analytics firms TRM Labs and Chainalysis saw similarities to earlier attacks blamed on North Korea.

The theft sits inside a wider pattern of crypto losses. Last year attackers stole two point nine billion dollars across nearly one hundred fifty attacks, TRM Labs said. Binance has three hundred thirty-five million registered users worldwide. It held about one hundred sixty-two point eight billion dollars in assets under custody, per its 2025 annual report.

What the restart does not prove

Every recovery figure above is Binance's own report, not an independent verification. A comprehensive proof-of-reserves update is the next test of those claims. Proof of reserves is a check that an exchange holds the assets it owes customers. Reports differ on the update's timing, so no date is stated here.

What remains unknown

What remains unknown starts with when the other fourteen phase-one assets actually open. Binance has not confirmed resumption beyond bitcoin. It has not said when the less liquid remainder will be fully sourced. Whether the reserves update matches the company's claims is also unknown. No independent party has verified the replenishment figures.

The tests that come next

The first test is whether bitcoin withdrawals keep working without widespread failures. Openings for ether, XRP, dogecoin and the other named assets will show the pace. The comprehensive proof-of-reserves update is the next check on backing. Independent verification will matter more than another company update.