Binance Begins Second Withdrawal Phase After $6.3B Hack, Reopening Nine Networks

Published November 3, 2026, 8:43 AM PKT. Based on Binance's Security Incident Recovery Update #6, as reported by Cointelegraph on November 3, 2026 (primary source), Reuters reporting on November 2, 2026, Cointime's November 3, 2026 summary of Update #6, and DefiLlama outflow data cited by Cointelegraph (secondary sources). This is a follow-up to MABOnChain's November 1 article on the first withdrawal phase, which covered 15 networks and 95% asset replenishment; this article covers only the second phase and what changed since.

Binance is opening a second phase of withdrawal reopening on Tuesday, November 3, 2026, five days after hackers drained about $6.3 billion from its hot wallets on October 29, in the largest crypto theft on record. Withdrawals for additional assets resume progressively from 04:00 UTC on Tuesday, which is 09:00 AM PKT and 12:00 PM Beijing time, according to Binance's Security Incident Recovery Update #6. The exchange said the rollout will proceed asset by asset as security and readiness checks are completed, in the same pattern as phase one, and that it is prioritising tokens based on user demand over the past week. Deposits remain available throughout, and Binance warned that processing may be delayed during the initial resumption because of high traffic.

Nine networks and the assets in phase two

The networks in the second phase are Binance Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base, according to Binance's notice, plus all bSTOCKS tokenised stocks on BSC. Cointime's summary of Update #6 lists the supported assets as including BTC, ETH, XRP, SOL, DOGE, ADA, LINK, SHIB, USD1 and FDUSD, and notes that not all assets become available immediately. The distinction matters for readers: phase two is not a single switch-on. It is a staged reopening across nine networks, with each asset cleared separately, so a token on one of the nine networks may still show as unavailable while others on the same network are already withdrawable. Binance has said it will bear all economic losses from the incident and will not pass them on to users, a commitment it repeated in Update #6.

Outflows slow as phase one settles

The second phase opens into a calmer flow picture than the first. DefiLlama data cited by Cointelegraph shows Binance's net outflows at $2.57 billion on Monday, down from $6.1 billion on Sunday, the first full day after withdrawals resumed. Phase one began on November 1 across 15 networks and assets including BTC, ETH, USDT, USDC, SOL, XRP and BNB, and in its first nine and a half hours Binance handled $4.65 billion in withdrawals against $1.01 billion in deposits, a net outflow of $3.64 billion, as MABOnChain reported. Binance has described total net outflows since reopening as around 3% of platform assets, and analysts cited by Reuters said the figure suggested customer confidence had largely held up. The exchange has also said it set aside more than $6.34 billion in company funds to cover the theft, and that about 95% of the stolen tokens have been replaced, figures that remain exchange-provided rather than independently verified.

Fiat withdrawals reopened on Monday

Alongside the crypto reopening, Binance said on Monday that it had reopened withdrawals for several fiat currencies, including the US dollar, the United Arab Emirates dirham, the Vietnamese dong, the Philippine peso and the Indonesian rupiah. Those five add to 23 other currencies already available for withdrawal, Cointelegraph reported. The fiat reopening is a separate track from the crypto phases, and it matters because it restores the off-ramp for users who want to exit to bank money rather than move coins to another exchange. No new timeline was given in Update #6 for the remaining crypto assets or networks outside the nine named, which stay subject to the same security-check gating.

The scam warning riding on the reopening

Binance paired the reopening with a security advisory dated November 2, warning that fraudsters are exploiting the phased schedule. Scammers are impersonating Binance representatives and offering accelerated withdrawals, priority processing for sales, help claiming compensation, or instructions to move assets into a purported Binance vault, the exchange said. Its advice is blunt: anyone promising to expedite a withdrawal for a fee is scamming you. Customers with pending withdrawals should check their status directly in the official Binance application and verify suspicious communications through the exchange's official verification service, Binance said. The warning is the practical takeaway of this phase for ordinary users, because the staggered schedule itself creates the waiting period that the scams exploit.

What comes next: the November 4 snapshot

The next dated milestone is November 4, when Binance plans to publish another reserve snapshot covering additional cryptocurrencies, beyond the October 31 snapshot whose zero-knowledge proof it completed on November 2 for ten major cryptocurrencies. Generating the accompanying proof is expected to take another 40 to 50 hours, according to reporting on the plan. That snapshot will be the first reserve evidence to cover assets beyond the initial ten, and it lands while investigators continue to trace the stolen funds: the FBI has attributed the theft to North Korea's TraderTraitor group, issuers have frozen more than $1.1 billion in USDC and more than $1.567 billion in USDT, and Elliptic has estimated the hackers still control about $3.28 billion, mostly in bitcoin and ether. The phase two rollout, the November 4 snapshot, and the frozen-funds tally are now the three numbers to watch in this recovery.

This article is news reporting and is not investment advice.

Sources

• Binance, Security Incident Recovery Update #6 (November 2, 2026), as reported by Cointelegraph, Binance Starts Second Withdrawal Phase After $6.3B Hack (November 3, 2026, primary source: second phase from 04:00 UTC Tuesday, nine networks, progressive rollout, demand-based prioritisation, fiat reopenings, DefiLlama outflow slowdown, scam warning)
• Reuters, Binance to reopen withdrawals for more assets on several networks (November 2, 2026, secondary source: Monday announcement, reopenings from 04:00 GMT Tuesday, networks including BSC, ETH, SOL, XRP and SUI plus Arbitrum, Optimism, TRX and Base)
• Cointime, Binance Gradually Resumes Withdrawals for More Assets Across Multiple Networks (November 3, 2026, secondary source: Update #6, 12:00 PM Beijing time start, asset list including BTC, ETH, XRP, SOL, DOGE, ADA, LINK, SHIB, USD1 and FDUSD, all bSTOCKS on BSC, gradual resumption, possible delays)
• CryptoNews, Binance warns of second wave of crypto theft as $6.3 billion hack recovery continues (November 3, 2026, secondary source: November 2 security advisory, November 4 expanded reserve snapshot, 40 to 50 hours for the zero-knowledge proof, October 31 snapshot proof completed November 2)