Binance Reopens Bitcoin Withdrawals After $6.3B Hack

Binance has begun a phased return of withdrawals after a security incident that compromised its hot-wallet infrastructure and affected an estimated $6.3 billion in digital assets. The exchange's decision to open the Bitcoin market first marks a significant operational milestone, although the reopening should not be confused with the completion of the investigation or recovery of the assets lost in the attack.

The company's November 1 support notice, published at 04:08 in the time format shown on its website, said that the first phase of withdrawals was scheduled between 06:00 and 09:00 UTC. The initial list included Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP and other networks. Binance warned that the availability of particular assets and networks could vary as its technical teams performed additional checks. AFP subsequently reported that Binance announced Bitcoin was the first network opened in the initial phase.

A major breach followed by a controlled reopening

The disruption began on October 29 at approximately 20:05 UTC, according to a company incident update. Binance said attackers had compromised its hot wallets, leading to unauthorized withdrawals of assets valued at approximately $6.3 billion. The preliminary findings evolved as the investigation progressed: the exchange initially cited a potentially compromised laptop, but later said it had identified additional points of breach. It also said it had found no evidence that wallet private keys had leaked. Those are company statements rather than independently established final forensic conclusions.

The scale of the incident placed pressure on Binance to demonstrate that it could restore customer access without creating additional vulnerabilities. In its October 30 update, the exchange said it had contained the compromised infrastructure, withdrawn affected authorizations and strengthened security controls. It reported cooperation with law enforcement, token issuers and blockchain intelligence firms to trace or freeze assets associated with the incident.

The withdrawal suspension was therefore not simply a temporary inconvenience. It became a test of the operating model of a large centralized exchange, in which users depend on the platform's infrastructure to move assets that may ultimately settle on decentralized networks. The Bitcoin network itself did not need to be compromised for customers to lose the ability to withdraw their Bitcoin from an affected intermediary.

What does the 95% recovery figure mean?

Binance said in its November 1 update that it had covered approximately 95% of the affected amount by using corporate resources and acquiring replacement tokens. The firm said its largest affected balances, including BTC, ETH, USDT, BNB, SOL and USDC, were fully backed. It described the remaining roughly 5% as less-liquid assets that would take longer to acquire at the necessary scale.

That distinction matters. Replenishing assets with company funds is not the same as recovering stolen assets from attackers. Binance separately reported efforts to trace and freeze compromised funds. Its statement that it would absorb the financial losses, rather than passing them to customers, is a commitment by the company; readers should distinguish that commitment from the outcome of any final audit, legal proceeding or forensic report.

The size of the reserve replacement effort also raises questions about liquidity management and financial resilience. An exchange facing a large, sudden shortfall may need access to liquid corporate assets, credit arrangements or market counterparties. The speed at which replacement tokens can be sourced depends on trading depth, particularly for smaller cryptocurrencies. The company has not yet published a complete independent account resolving every uncertainty surrounding the breach.

Why Bitcoin reopened first

Bitcoin is the highest-profile cryptocurrency and a major withdrawal route for exchange customers. Opening the BTC network first was an operational and symbolic step: it allowed the exchange to demonstrate progress on a heavily used network while monitoring demand, transaction processing and security conditions. It did not establish that every listed network was simultaneously available to every customer.

Binance said withdrawal networks and assets would come online progressively and that customers could experience delays or failed requests during the initial rollout. It directed users to individual network status and withdrawal pages for current availability. Users should rely on those operational notices rather than assuming that one announcement means all services have returned to normal.

The incident has also reignited scrutiny of reserve disclosures. Binance said it would provide proof-of-reserves information, but an exchange reserve snapshot alone does not necessarily establish the full range of corporate liabilities or explain the financial treatment of every loss. An independent assessment would need to consider custody controls, off-chain obligations, reserve composition and the separation of customer and corporate funds.

The questions that remain

For the broader crypto industry, the episode highlights a persistent structural risk. Blockchain settlement systems may be resilient while the custodians and software systems that connect customers to them remain vulnerable. Centralized exchanges offer convenience and liquidity, but customers also assume operational and counterparty exposure.

Investors and customers will be watching for three developments: the complete restoration of withdrawal routes, independent confirmation of balances and replacement reserves, and a detailed post-incident account explaining the attack path and the safeguards introduced afterward. Binance said it intended to publish further findings when the investigation was complete.

Bitcoin withdrawal access is therefore a recovery milestone, not the end of the story. The longer-term impact on customer confidence will depend less on the timing of the first reopening than on the evidence Binance provides about how it handled the loss and how it intends to prevent a repeat.