Binance withdrawals resumed: Bitcoin, ether, USDT and XRP back after $6.3bn hack

Binance reopened withdrawals on Sunday, starting with Bitcoin. Which coins are back, how much of the stolen money it has replaced, and what to check first.

A person looking at a screen of falling green numbers
Image: Ron Lach / Pexels

Binance switched withdrawals back on on Sunday, 1 November, starting with Bitcoin shortly after 11 AM Pakistan time (06:00 GMT). This is the new part since our report this morning: the exchange has kept its promised date, and it now says it has replaced about 95% of the roughly $6.3 billion stolen on Thursday night, up from 90% a day earlier.

Which coins can you withdraw now?

The restart is in phases. The first phase covers 15 assets, led by the most-used networks: Bitcoin (BTC), ether (ETH), Tether (USDT), USD Coin (USDC), BNB and XRP, with dogecoin among the others. Ether came back a little after Bitcoin. Binance says every other coin and network will reopen only after it passes its own security and stability checks, and it has not given a date for the next phase.

“Restoring access to user funds is a priority, and we are taking a controlled approach to do so safely,” a Binance spokesperson said. The company repeated that “these losses will not be passed on to users” and that it will publish a full proof-of-reserves report.

How Binance covered the hole

Binance says it bought replacement tokens worth about $6 billion with its own money. That came from its $1 billion emergency fund for users (SAFU), part of its futures insurance fund and the company treasury. Co-CEO Yi He said on Saturday that half of SAFU would be used and that the fund would be topped back up to about $1 billion. The missing 5% is in smaller, less traded coins outside the top ten, which take longer to buy in bulk.

About $3 billion of the stolen crypto, mostly USDT and USDC, has been frozen with help from the companies that issue those stablecoins. Bitcoin and ether cannot be frozen that way, which is why the FBI says it expects the thieves, the North Korean unit it calls TraderTraitor, to keep laundering them. Co-CEO Richard Teng has described the breach as a “complex attack” that began with a compromised laptop.

What Pakistani users should do

  • Check the network before you withdraw. If your coin or network is not in phase one, the button stays greyed out; that is expected, not a sign your money is gone.
  • Expect queues. Withdrawals may be slower than usual for a few days.
  • Ignore anyone in DMs or WhatsApp offering to “unlock” your Binance funds for a fee. Binance does not do this.
  • Crypto trading rules in Pakistan are still being set by the new virtual assets regulator, PVARA, and the State Bank, so local legal protection for exchange users remains limited.

Bitcoin was trading around $77,800 on Sunday afternoon, after falling on Friday when the hack came to light. Binance has not said when the remaining coins will reopen; that and the proof-of-reserves report are the next things to watch.

This is information, not investment advice.

Read next