The news sent shockwaves through the crypto world: Binance had been hit by the largest crypto theft in its history—$6.34 billion stolen in a single attack. When the exchange announced the phased resumption of withdrawals, it marked a cautious step toward recovery after initially suspending withdrawals for a security assessment. Binance prioritized assets using user demand data from the past week, restoring each network and asset pair carefully with stability and security checks completed before access reopened.
The first phase, beginning on November 1, 2026, opened with the Bitcoin network. CZ wrote, “BTC withdrawal is live,” while Binance said the first batch opened in phase one was the BTC network. The exchange also emphasized that its top 10 assets, including Bitcoin (BTC), Ethereum (ETH), and Tether (USDT), were fully backed. The phase-one withdrawal window was 11:00 AM–02:00 PM PKT, and deposits remained unaffected.
Binance’s decision came after the exchange covered 95% of the stolen funds through market purchases, an increase from the previously reported 90%. The remaining 5% consisted of less liquid assets. Binance set aside more than $6.34 billion in company funds to cover the losses and said user funds remained safe.
34 billion in company funds to cover the losses and said user funds remained safe.
The exchange initially suspended withdrawals while conducting a security assessment and assessing the damage. The news triggered a sharp decline in major cryptocurrency prices on Friday.
The FBI confirmed that North Korea’s TraderTraitor hacking group was responsible for the attack, aligning with earlier suspicions from private investigators and analysts. North Korea operates a sophisticated hacking network linked to multiple high-profile cyber thefts and believed to fund its weapons programs.
Binance’s phased approach is designed to restore access carefully, with stability and security checks completed before each network and asset pair reopens. The exchange says user funds remain safe and that it will absorb the financial impact of the stolen funds, not its users.
With 95% of the stolen funds covered and the BTC network reopened, Binance is moving forward with withdrawals in controlled phases as it works through the remaining less liquid assets.
