Binance Withdrawals Are Live Again for 15 Assets as Coverage Hits 95%

Published November 1, 2026, 1:20 PM PKT. Based on Binance's Recovery Update #4 published November 1, 2026 (primary source) and Reuters reporting of November 1, 2026 (primary source), with background from MABOnChain's November 1 coverage of the Phase One schedule and the FBI attribution. This is a follow-up to MABOnChain's earlier November 1 article on the Phase One schedule: where that article reported a planned window, this article reports the reopening actually under way.

Binance resumed withdrawals on Sunday, November 1, 2026, posting on its status page shortly after 0600 GMT that the planned withdrawals had begun, Reuters reported November 1. The first phase covers 15 cryptoassets including bitcoin, ether, XRP and dogecoin, according to Reuters, and Binance said on X that the first batch network is the bitcoin network. The restart is the first time customers have been able to move funds off the exchange since withdrawals were suspended after the October 29 hack that drained about $6.3 billion from Binance hot wallets, an attack the FBI said on October 31 was carried out by North Korea's TraderTraitor group. Deposits stayed open throughout the suspension, according to TradingView's report of the reopening, so withdrawals were the only side of the ledger frozen, and they are now returning in stages rather than all at once.

Withdrawals began shortly after 0600 GMT, in stages

The live start matters because the morning's earlier reporting was only a schedule. Binance's November 1 update, Recovery Update #4, had set a Phase One window of 06:00 to 09:00 UTC, which is 11:00 AM to 2:00 PM Pakistan time, with assets and networks prioritized by user demand over the past week and each service returning only after its own security and stability checks, as MABOnChain reported earlier November 1. Reuters confirmed the schedule became reality shortly after the window opened, when Binance posted on its status page that the planned withdrawals had begun. Binance had warned in advance that heavy initial traffic could cause delays or failed withdrawals, and that warning still applies inside the window: a delayed withdrawal is, on Binance's own framing, a congestion outcome in the first hours of a backlog clearing, not evidence of a new incident, though users should still verify any withdrawal on the exchange's own announcements page rather than trusting social media claims.

The first batch, as listed in the November 1 update and reported by Cointime, BBX and TokenPost, is BTC, ETH, BNB, TRX, SOL, XRP, ZEC, DOGE, TON, POL, AVAX, ARB, BASE, OP and SUI. TradingView's report of the live restart describes the same structure as the bitcoin network reopening alongside 14 other networks, for 15 in total during this first phase, chosen using recent user demand data. Later phases are expected to follow only after additional security checks, Binance said, and the exchange has not presented the full rollout as a single switch being flipped back on. That sequencing is the key limit on today's news: customers holding assets outside the first 15 are still waiting, and Binance has given no date for Phase Two.

Coverage rises to 95 percent, with SAFU paying part of the bill

Binance said in Recovery Update #4 that it has now covered approximately 95 percent of the impacted amount, up from 90 percent in its previous update and about 80 percent on October 30, according to the update as carried on Binance Square and reported by TokenPost and U.Today. Balances in ten named assets are fully backed at 100 percent, Binance said: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 5 percent consists of tokens outside that top ten list, which are less liquid in the market and take longer to source at the required scale, Binance said, and it continues buying them through market and over-the-counter channels. Reuters put the covered amount at about $6 billion of the roughly $6.3 billion stolen, and said Binance has set aside around $6.34 billion of company funds internally to cover the losses.

The funding mix is now clearer than it was in the first updates. The replacement purchases came from Binance's $1 billion Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund and its corporate treasury, Reuters reported, citing Binance's statements on X. Co-CEO Yi He said on Saturday that 50 percent of SAFU funds would be used, while the company committed to replenishing the fund to about $1 billion, according to Reuters. Separately, Binance has been working with industry partners to freeze some of the affected assets, with about $3 billion located as of Friday, Reuters reported, a figure that describes frozen or located stolen assets and is separate from the replacement tokens Binance bought with company money. TokenPost stressed the distinction readers most need: the 95 percent figure describes the amount Binance says it has covered, not stolen funds recovered, and the two must not be conflated.

What is still unproven: Phase Two, the full proof, the post-mortem

Three milestones still sit ahead, and none is settled by withdrawals going live. Binance published a new proof of reserves snapshot taken at midnight UTC on October 31, but the full cryptographic proof, which lets customers verify that their balances are backed, is due November 3, and TokenPost reported the exchange is targeting November 2 to 3 Eastern Time for the full zero-knowledge proofs. A snapshot, the later verification process and the status of withdrawals are different stages of the recovery, as one analysis of the update noted, so the snapshot alone cannot settle every question raised by a theft of this size. Binance has also promised a fuller account after its investigation, and no post-mortem has been published yet. On the attack itself, TRM Labs said the bulk of the theft unfolded in around 20 minutes beginning late on Thursday, October 29, according to Reuters, and the FBI said the attackers are converting stolen assets primarily into ether and are expected to launder them further through DeFi and instant swap services.

The political argument around the hack is also unresolved. US President Donald Trump said on Saturday that the US was still not certain North Korea was involved, Reuters reported, quoting him as saying, "We don't know if it's North Korea, but if it is, we'll talk to North Korea about it." That sits in tension with the FBI's October 31 statement attributing the theft to TraderTraitor, which MABOnChain reported November 1, and with TRM Labs and Chainalysis, which had reached the same attribution from on-chain analysis before the FBI spoke. The attribution question matters for recovery, because the FBI, the US Secret Service and IRS Criminal Investigation have urged firms to block transactions linked to hundreds of published TraderTraitor addresses, but an attribution, even a formal government one, does not by itself recover frozen or stolen funds. For Binance's 335 million registered users, and about $162.8 billion in assets under custody cited from its 2025 annual report by Reuters, the practical test that started November 1 is simpler: whether withdrawals keep flowing through the Phase One window and into Phase Two without new pauses.

This article is news reporting and is not investment advice.

Sources

• Binance, Security Incident, Recovery Update #4: Withdrawals Resume in Phases (November 1, 2026) (primary source for the Phase One window of 06:00 to 09:00 UTC, the 95 percent coverage figure up from 90 percent, the ten fully-backed assets, the remaining 5 percent in less-liquid tokens outside the top ten, market and over-the-counter purchases, and the proof of reserves snapshot)
• Reuters, Binance Resumes Bitcoin Withdrawals After $6.3 Billion Crypto Heist (November 1, 2026, primary source for the status page post shortly after 0600 GMT that the planned withdrawals had begun, the 15-cryptoasset first phase, the $6 billion covered figure, the $6.34 billion set aside, the SAFU and futures insurance fund mix, Yi He's 50 percent SAFU statement and $1 billion replenishment commitment, about $3 billion located as of Friday, the 335 million users and $162.8 billion custody figures, and President Trump's Saturday remarks)
• TokenPost, Binance Schedules Phased Crypto Withdrawal Restart After $6.3B Breach (November 1, 2026, secondary source for the 15-network first phase, the 95 percent replenishment figure, and the distinction that 95 percent describes the amount covered, not stolen funds recovered)
• TokenPost, Binance Said It Had Covered About 95% of the Amount Affected by an Oct. 29 Security Incident (November 1, 2026, secondary source for the hot wallets compromised on October 29, the $6.3 billion estimate, and the company-funds commitment)
• U.Today, Binance to Resume XRP, Bitcoin, Ethereum and Other Crypto Withdrawals (November 1, 2026, secondary source corroborating the 95 percent figure up from 90 percent, the 06:00 to 09:00 UTC window, and the fully-backed list)
• MABOnChain, Binance Reopens Withdrawals in Phases From 11 AM PKT, Starting With 15 Assets (November 1, 2026, background source for the Phase One schedule, demand-based prioritization, per-service security and stability checks, the delay warning, and the November 3 full proof timeline)
• MABOnChain, FBI Blames North Korea for $6 Billion Binance Hack, Urges Firms to Block TraderTraitor Wallets (November 1, 2026, background source for the FBI TraderTraitor attribution and the address-blocking request)
• MABOnChain, Binance Says 90% of Stolen Crypto Replaced as November 3 Proof Nears (October 31, 2026, background source for the earlier 90 percent replenishment figure and the $6.34 billion reserve)