Binance Opens a Second Withdrawal Phase as Outflows Slow After the $6.3 Billion Hack

Binance began a second phase of withdrawal reopening at 04:00 UTC on Tuesday, restoring more assets progressively after the record hack.

Binance announced the phase in Recovery Update #6 at 02:40 UTC on Tuesday, November 3. Withdrawals had been halted since the October 29 theft of about 6.3 billion dollars. Phase one reopened fifteen networks on Sunday, November 1.

Nine networks, opened one check at a time

The nine networks are BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base. The update's lists run to dozens of network and asset pairs. On BNB Smart Chain alone, Binance names thirty-one assets, plus all of its tokenized bSTOCKS shares.

"Like phase one, reopening will roll out progressively across the assets as security and readiness checks are completed," Binance said. Not every listed asset opens at once, and each network and asset pair returns only after its own checks finish.

Binance said it prioritized tokens by user demand over the past week. Deposits stayed open throughout and remain unaffected by the reopening, and the exchange warned that traffic could delay processing during the rollout. Users whose withdrawal fails should try again later, it said. Availability can be checked on the withdrawal page or the network status page.

Fiat withdrawals widened on Monday as well. Binance reopened the United States dollar, the United Arab Emirates dirham, the Vietnamese dong, the Philippine peso and the Indonesian rupiah. Those five joined twenty-three other currencies already available for withdrawal.

Binance reiterated that it bears the financial impact of the stolen funds, and that the losses will not be passed on to users. That pledge has been repeated in each recovery update since the theft.

Outflows are slowing, on two different measures

The rush to leave is easing, on the daily measure. DefiLlama data put net outflows at 2.57 billion dollars on Monday. That compares with 6.1 billion dollars on Sunday, Cointelegraph reported. That is a drop of more than half in a day, by TickerGrove's calculation from those figures.

Phase one's opening hours were heavier, on Binance's own count. In its first nine and a half hours, Binance handled 4.65 billion dollars of withdrawals. Deposits over the same stretch came to 1.01 billion dollars. That is a different measure from the DefiLlama daily figures, and the two should not be blended.

No phase-two flow figures exist yet. The phase began only at 04:00 UTC on Tuesday. Whether the calmer Monday pace holds once more assets open is the next test.

The reserves proof users were promised

A proof of reserves is a check that customer balances are backed. Binance has completed the full zero-knowledge proof — a proof verified without revealing underlying data — for its October 31 snapshot. The snapshot was taken at 00:00 UTC on October 31. The completion came in Recovery Update #5, announced on Monday, November 2.

Holders of ten tokens can now verify that their own balance is backed at least one to one. The ten are bitcoin, ether, tether, BNB, solana, USD Coin, XRP, USD1, RLUSD and ZEC. The check uses Binance's verifier, built on a Merkle tree and zk-SNARK cryptography, which users run on their own computer.

About ninety-five percent of the affected assets are covered, and the remaining five percent are lower-liquidity tokens outside the top ten. Binance is still acquiring those through market and over-the-counter purchases. A new snapshot is planned for November 4, covering more tokens. Its proof is estimated to take about forty to fifty hours.

The proof has a limit readers should keep in view. It shows that balances in those tokens are backed. It does not by itself establish the exchange's complete financial position.

A warning about fake help

Binance also warned that scammers are impersonating the exchange during the phased reopening. The offers include accelerated withdrawals and priority processing for a fee. Others offer help claiming compensation, or direct users to move assets into a purported Binance vault. "Anyone promising to expedite it for a fee is scamming you," Binance said.

What remains unknown

What remains unknown starts with the locked list. Assets in neither phase remain unavailable for withdrawal. Binance has given no date for any later phase. The exchange has also not published its promised post-incident technical report. That document is still outstanding, five days after the theft.

How phase two itself performs is also unknown. No withdrawal or outflow figures for the phase exist yet, and delays, failed withdrawals and the pace of the rollout will show first on the network status page.

What to watch next

What to watch next is the November 4 reserves snapshot. It should cover more tokens than the first ten, and its zero-knowledge proof will take an estimated forty to fifty hours after that. Watch, too, for the assets still locked after phase two. Each new recovery update either shrinks that list or leaves it standing. Finally, watch the daily outflow figures. A second calmer day would suggest the exit pressure is fading. A renewed spike as more assets open would say otherwise.