Binance has started letting users withdraw crypto again, three days after a hack estimated at about $6.3 billion, the largest on record.
Withdrawals for Bitcoin and assets on 15 other blockchains reopened on Sunday, 1 November, in a first window that ran from 06:00 to 09:00 UTC. Named assets included BTC, ETH, USDT, USDC, BNB and XRP, with the most-requested networks put first. Binance later opened more assets for withdrawal.
“Restoring access to user funds is a priority, and we are taking a controlled approach to do so safely,” a Binance spokesperson said in a statement.
A phased return
The rest of the reopening will happen in phases. Each blockchain must pass its own security and stability checks before withdrawals resume, and Binance had not given a timeline for the later phases at the time of writing.
“Resuming withdrawals is a major milestone, but our work continues,” the spokesperson said.
Binance says 95% of losses covered
Binance says it will absorb the cost of the theft so users do not bear the loss. The exchange says it has now replaced about 95% of the affected assets using company funds, including its Secure Asset Fund for Users (SAFU) emergency reserve, up from 90% a day earlier.
The remaining 5% is made up of tokens outside the top ten, which are less liquid and slower to source. Binance says it is still buying them through market and over-the-counter channels.
On reserves, the spokesperson said: “All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed 100%.” Users can check a snapshot on Binance’s proof of reserves page, and the exchange has promised a full, audit-style proof of reserves report.
What was taken
The attack hit Binance’s hot wallets late on Thursday. Blockchain analytics firm TRM Labs says the haul included 18,270 BTC, worth about $1.47 billion, along with 200,630 ETH, 1.875 billion USDT and 823 million USDC on Ethereum, plus XRP, SOL and more USDT on other blockchains.
About $3 billion of the stolen funds has been frozen, mostly USDT and USDC, which their issuers can block. Bitcoin and Ether cannot be frozen in the same way.
Blockchain analytics firms have linked the attack to TraderTraitor, a group tied to North Korea. Binance has not confirmed who was behind the hack at the time of writing.
What happens next
Users should watch for Binance’s updates on which networks reopen next. The full proof of reserves report and the sourcing of the last 5% of stolen tokens are the next markers of whether Binance has fully recovered from the hack.
