After more than two days in which customers could not move their crypto, Binance has started opening the doors again. The world’s largest cryptocurrency exchange began the first phase of restoring withdrawals on Sunday, with the bitcoin network among the first to reopen.
The first phase runs in a window between 06:00 and 09:00 UTC — 11:00am to 2:00pm Pakistan time — and covers 15 networks in total. Alongside bitcoin, the batch includes ether, BNB Smart Chain, Tron, Solana, XRP, dogecoin and other tokens. Binance says it picked the order from recent user demand data: the networks people were most eager to withdraw from got priority. Access returns network by network and asset by asset, not all at once, and the exchange has warned users to expect delays or failed attempts in the first hours as traffic surges.
The reopening comes with a new recovery figure. Binance says it has now replaced about 95% of the roughly $6.3 billion stolen in the October 29 attack, up from 90% a day earlier. The replacement tokens were bought with company money, and Binance says balances in ten major assets — bitcoin, ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash — are now fully backed. “Binance will absorb the financial impact of these stolen funds, not our users,” the company said in its October 31 update.
That leaves a remainder that matters. The missing 5% consists of less liquid tokens that take longer to buy in the required amounts, and Binance has not given a date for them. Later phases of the reopening will follow only after further security checks, so customers holding tokens outside the first batch are still waiting. Anyone planning a withdrawal should check the status of their specific asset and network first rather than assuming the whole platform is back.
The attack itself remains the largest cryptocurrency heist on record. Binance’s hot wallets — the online systems an exchange uses to process withdrawals quickly — were drained late on October 29, and withdrawals were frozen while the company scrambled to cover the gap. The FBI said on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible, and that its members had been observed converting stolen assets into ether, with further laundering expected. Around $3 billion of the stolen assets has separately been frozen by industry partners including Tether and Circle, a different pool from the replacement tokens Binance has bought. Readers can follow the earlier stages of this story in our first report on the suspension and our update putting the theft at $6.3 billion.
What is still unproven is as important as what Binance has announced. Every recovery figure so far is the company’s own report. Security firm CertiK has said it needs more information to verify the claimed $5 billion in replacement holdings, and the full cryptographic proof of reserves — the evidence that would let customers check independently — is not due until November 3, because Binance says the zero-knowledge proof takes 40 to 50 hours to generate. The exchange has also committed to restoring its emergency SAFU reserve to about $1 billion after drawing on it, which means the fund that protects users in a collapse is thinner during the recovery window.
That is why this reopening is the real test of everything Binance has claimed. A proof-of-reserves snapshot is a document; withdrawals going through are the evidence. If bitcoin, ether and the rest of the first batch move smoothly over the coming days, the exchange starts rebuilding the trust a $6.3 billion breach destroys. If withdrawals stall, or if the November 3 proof disappoints, the questions come back sharper than before — not just for Binance, but for an industry where a single exchange holds the savings of millions of people who cannot see inside its wallets. For now, the doors are open part-way. The full verdict waits on the money actually moving, and on the proof still to come.
