Binance To Begin Customer Withdrawals In Phases After $6.3B Heist: What Phase 1 Includes

Binance, the world's biggest cryptocurrency exchange, is set to gradually restore withdrawal services following a security breach that resulted in the theft of digital assets valued at around $6.3 billion, with the initial phase of the restoration planned for November 1.According to its November 1 update, Binance will reopen withdrawals within a three-hour window starting at 06:00 GMT, initially allowing transactions involving a limited number of cryptocurrencies and blockchain networks once the necessary safety and system checks are completed.

Binance said withdrawals would be reinstated gradually to avoid disruptions and ensure its systems could handle transactions securely. The initial selection of supported cryptocurrencies and blockchain networks was determined by analysing customer withdrawal patterns and demand recorded over the preceding seven days.https://t.

co/pBJaht1UGV— Binance (@binance) November 1, 2026Users have been advised to check the withdrawal page for their selected cryptocurrency and network, as availability may vary during the initial rollout. The exchange also cautioned that customers could encounter temporary delays or longer processing times because of increased traffic. If a withdrawal request involving an eligible token or network fails, users may try again after some time.

ALSO READ: FBI Points Finger At North Korea For Record $6 Billion Binance Crypto HeistWhat Binance Said About Customer FundsReassuring customers over the financial implications of the breach, Binance reiterated that users' funds remain safe and that the company would absorb the entire financial impact of the stolen assets.In its November 1 update, the exchange said it had now covered approximately 95% of the affected amount, compared with 90% reported in its previous communication. Binance said the remaining 5% involved tokens outside the 10 major cryptocurrencies whose balances have already been fully backed.

These assets are comparatively less liquid and are taking longer to source in the required quantities. The exchange said it was continuing to purchase the outstanding assets through cryptocurrency markets and over-the-counter (OTC) channels.It also confirmed that balances in Bitcoin, Ethereum, Tether (USDT), BNB, Solana, USD Coin (USDC), XRP, USD1, RLUSD and Zcash were fully backed at 100%.

Customers can independently check the exchange's proof-of-reserves snapshot through its Proof of Reserves website, Binance said.ALSO READ: Binance Hack: Crypto Exchange Says 90% Of Stolen Assets ReplenishedWhy Did Binance Suspend Withdrawals?Binance temporarily halted withdrawals as a precautionary measure following the security incident.

The suspension was intended to give its security teams time to contain the breach, assess the extent of the damage, restore affected services and complete additional checks before reopening access.According to the exchange, its teams have since undertaken enhanced security reviews of affected services, examined withdrawal infrastructure, verified operational readiness and monitored the platform for potential residual risks.Binance has also been working with law enforcement agencies and industry partners to trace and recover the stolen cryptocurrency.

The company said its recovery efforts included replenishing affected assets using its own financial resources.The exchange acknowledged the inconvenience caused by the temporary suspension, describing the restoration of withdrawal facilities as an important milestone in its recovery process.Who Was Behind The $6.

3 Billion Crypto Heist?The incident has also drawn international attention after the US Federal Bureau of Investigation (FBI) attributed the cyberattack to TraderTraitor, a North Korean state-sponsored hacking group.In a statement, the FBI said members of the group had been observed converting stolen assets into Ethereum.

The agency also warned that further attempts to launder the cryptocurrency through related technologies were expected.North Korea has repeatedly rejected allegations linking it to state-sponsored cyber operations involving espionage and financial theft. Pyongyang had not publicly commented on the latest allegations at the time of publication.

How Did The Binance Security Breach Happen?Binance's preliminary investigation suggested that the attackers gained access to systems associated with withdrawals and used them to facilitate unauthorised transfers from cryptocurrency wallets. Initial findings pointed towards a possible compromise of an engineer's laptop, although the exchange subsequently identified additional potential points of intrusion.

The attack reportedly involved malicious software designed to erase traces of the hackers' activities. Binance has maintained that its private keys were not compromised.The incident has once again highlighted the cybersecurity risks facing cryptocurrency exchanges, particularly those operating internet-connected hot wallets used for routine transactions.

What Happens Next?Binance said it would continue monitoring the platform as withdrawals are restored, with additional assets and networks becoming available after completing security and readiness checks. The exchange also thanked industry partners for helping freeze suspicious assets and trace the stolen funds, adding that it would continue cooperating with law enforcement agencies.

Once the investigation is concluded, Binance plans to publish a detailed post-incident report explaining the circumstances surrounding the breach. The company reiterated that customers would not bear the financial consequences of the attack, adding that replenishing the remaining affected assets and strengthening its security systems remained priorities.