Binance reopened withdrawals in phases on Nov. 1, starting with Bitcoin1. The exchange says it has replaced 95% of the $6.3 billion a hacker took three days earlier2. Its hacker fared worse. On-chain records show that wallet sold $5 million in one token for 71 dollars3. The liquidity pool it used sat nearly empty of buyers.
Bitcoin Leads a Careful Restart
Richard Teng's exchange posted the update at 06:20 UTC. “Update: First batch network now opened in phase one of withdrawals is $BTC bitcoin network,” Binance wrote1. Bitcoin carried the single biggest piece of the theft. Attackers took 18,270 BTC, worth about $1.47 billion at the time, blockchain intelligence firm TRM Labs found4.
An hour and a half later, Binance restored more. “Withdrawal Update. Withdrawals have now been restored for the following assets and networks: Ethereum Network: USDC, USDT, ETH. BNB Smart Chain (BSC): USDC, USDT, BNB,” the exchange posted at 07:49 UTC5. Fifteen more blockchains followed the same phased rollout, CoinDesk reported6. Binance warned that early traffic could slow a withdrawal request, and asked users to try again rather than assume a failure.
Caution shaped every step. Each network needed its own security check before Binance reopened it, the exchange said6. Speed mattered less than sequence this time, after three days of paused withdrawals across the exchange.
Read as strategy, the order fits the flaw. Bitcoin's wallets skip the delegation feature attackers used three days earlier to seize control of Binance's hot wallet4. Starting there let Binance test its fix on the one major chain that same flaw left untouched.
Both sides, in their own words
Does a 95% balance sheet answer the question a reader with money on the exchange actually wants answered?
“We've now replenished approximately 95% of the impacted assets, and our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users”
“I think you should be very wary of leaving any significant amount of funds in an exchange”
Teng Puts a Number on the Recovery
Richard Teng posted his own count nine minutes before Bitcoin reopened. “We've now replenished approximately 95% of the impacted assets, and our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng wrote at 05:11 UTC2. That is up from 90% a day earlier.
Richard Teng@_RichardTengToday, we're beginning the phased resumption of withdrawals, taking a careful approach to ensure services return safely and securely.
We've now replenished approximately 95% of the impacted assets, and our commitment remains clear: Binance will absorb the financial impact of the… https://t.co/wKvI7Q4fsT pic.twitter.com/uWFGs3sJJ5
Binance had already set aside $6.34 billion to cover the hack, Teng said in a video address Friday7. “We are committed to covering all hacked losses through our company funds. Your assets are safe,” he said then. Ten assets now sit fully backed: bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC8. The other 5%, about $315 million, stays open, outside that list.
Three pools built the $6.34 billion, AMBCrypto reported15. Binance drew $581 million from the Secure Asset Fund for Users, its emergency reserve. Another $425 million came from its futures insurance fund. The remaining $4.7 billion came from the company's own balance sheet, an amount Binance has yet to break down further.
The Hacker's Own Trade Loses Millions
Binance's hacker had less to show for the week. A wallet tied to the exchange's hack swapped 908,793 PROM tokens for 0.0316 ether at 04:28 UTC on Oct. 31, Etherscan's own record shows3.
Those tokens carried a market value near $5 million before the trade3.
The ether that came back was worth $71 at that same moment3. This same wallet made a costly swap days earlier too. It sent tokens worth $3.3 million to $3.5 million to a contract address that now sits beyond anyone's reach, Crypto Briefing reported10.
Lookonchain, a pseudonymous on-chain analyst, flagged the PROM trade a day later. “The Binance hacker made a $5M mistake while dumping altcoins! The hacker sold 908,793 $PROM (worth ~$5M) into a nearly empty Uniswap V2 liquidity pool and received just 0.0316 $ETH ($71),” Lookonchain posted9.
Lookonchain@lookonchainThe Binance hacker made a $5M mistake while dumping altcoins!
The hacker sold 908,793 $PROM (worth ~$5M) into a nearly empty Uniswap V2 liquidity pool and received just 0.0316 $ETH ($71).https://t.co/3DNdmFjvRp pic.twitter.com/l0llpzyjSi
A pool on Uniswap prices a token by the ratio it holds. Flood a thin pool with one token, and its price falls with every sale, Crypto Briefing reported. Traders call the difference between a quoted price and a trade's real price slippage10. The hacker's $5 million position returned about $14 for every million dollars of paper value.
The PROM trade covers a sliver of what the hacker still holds. Its wallets control more than 420,000 ether and 18,270 bitcoin beyond any issuer's reach, worth about $2.4 billion, TRM Labs found4. One bad trade on a thin pool barely dents a hoard that size.
A Security Professor Says the Risk Holds Steady
Richard Teng's math and the hacker's mistake share one thing. Both skip the question of whether an exchange is a safe place to hold money. Tyler Moore, a cybersecurity professor at the University of Tulsa, studies that question for a living11.
“I think you should be very wary of leaving any significant amount of funds in an exchange,” Moore told CNBC11. Banks carry federal deposit insurance up to $250,000 per account. An exchange carries a promise from its own executives instead.
Ryan Kirkley, chief executive of Global Settlement Network, read the same week the same way. “I do not think there's anything right now that is a common solution,” Kirkley told CNBC, on what protects a trader's funds once they sit on an exchange11.
Other voices read the same risk differently. Ido Ben-Natan, chief executive of the blockchain security firm Blockaid, pointed to the money both companies promised to pay back. "I actually think no users will lose any money," Ben-Natan told CNBC, calling continued use of exchanges a reasonable choice11.
Binance and Polymarket, which lost $2.7 million the same week to a separate breach, both told users they would cover the losses. Moore's point stands apart from either company's balance sheet. The risk he names lives in the custody model itself, apart from this week's recovery count.
What 95% Still Leaves Open
A new detail appeared within Binance's own recovery Sunday. Whale Alert, a tracking account, flagged a transfer of 2,000 BTC, worth about $156 million, from Binance to an unfamiliar address13. Yi He, Binance's co-founder, answered within the hour. “That is a new Binance wallet address. New withdraw addresses already added into PoR,” she wrote at 06:59 UTC14.
Yi He@heyibinanceThat is a new Binance wallet address.
New withdraw addresses already added into PoR. 💛
PoR is Binance's proof of reserves, the page where it lists every wallet it controls. Yi He's answer closed the question fast. It also showed how closely outsiders now watch every address tied to Binance, three days after the theft.
Math alone will yet decide the 95% figure. Binance expects its full cryptographic proof of reserves by Nov. 3, Vietnam time, TokenPost reported16. That proof checks every wallet against a snapshot of customer balances. It uses Merkle trees and a method called zk-SNARKs. Every single account stays hidden from view.
Binance Says It Replaced $6B of the $6.3B Stolen Oct. 29, Up From 90%
Money Binance says it has repaid versus what stays open, in billions of dollars, Nov. 1, 2026
- Replaced: $5,985M
- Still open: $315M
Sources: X (Richard Teng, @_RichardTeng) [2]; TRM Labs [4].
Read the chart as a table
| Item | Value |
|---|---|
| Replaced | $5,985M |
| Still open | $315M |
Two charts tell the same week two ways. The first totals what Binance says it has repaid against what stays open. A second lines up the week's four dated turns, from the theft itself to Sunday's restart.
Binance Reopened Withdrawals Nov. 1, 3 Days After a $71 Sale
Four dated events in the Binance hack's recovery, Oct. 29 to Nov. 1, 2026
Read the chart as a table
| Date | Event |
|---|---|
| Oct. 29, 2026 | Binance hot wallets lose $6.3B |
| Oct. 30, 2026 | Binance sets aside $6.34B, vows cover |
| Oct. 31, 2026 | Hacker's wallet sells PROM for $71 |
| Nov. 1, 2026 | Binance reopens withdrawals at 95% |
By the numbers
- $6.3 billion: the total Binance says a hacker took from its hot wallets Oct. 294.
- 18,270 BTC, worth about $1.47 billion, made up the single biggest piece of the theft, TRM Labs found4.
- 95%: the share of stolen funds Binance says it has replaced, up from 90% a day earlier2.
- $6.34 billion: the company funds Binance set aside to cover the loss7.
- 908,793: the PROM tokens the hacker's wallet sold for 0.0316 ether, about $71, at 04:28 UTC Oct. 313.
- $713.51: BNB's price at 12:03 UTC Nov. 1, little changed through the week's recovery news12.
- 3,155: the likes on Binance's post restoring Ethereum and BNB Chain withdrawals, counted Nov. 15.
What to watch
Nov. 3 brings the real test of Binance's count. An outside audit, rather than Binance's own math, would settle the 95% question. Which networks join Bitcoin, Ethereum and BNB Chain next, and how fast, will say how far the restart has to go. The hacker's wallet still holds tokens it has yet to sell, each one a chance to repeat Saturday's mistake.
Sources
- Binance, "Update: First batch network now opened in phase one of withdrawals is $BTC bitcoin network," post on X, Nov. 1, 2026, https://x.com/binance/status/2116777408074600621
- Richard Teng, "Today, we're beginning the phased resumption of withdrawals," post on X, Nov. 1, 2026, https://x.com/_RichardTeng/status/2116760027570864240
- Etherscan, transaction 0x3854…9164, Oct. 31, 2026, https://etherscan.io/tx/0x38546f9087ba0eb8444965711eb64a89fe9f53e80cd6d416317c847308219164
- TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History," Oct. 29, 2026, https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- Binance, "Withdrawal Update," post on X, Nov. 1, 2026, https://x.com/binance/status/2116799757507305516
- Omkar Godbole, "Binance opens crypto withdrawals in phases starting with bitcoin following $6.3 billion hack," CoinDesk, Nov. 1, 2026, https://www.coindesk.com/markets/2026/11/01/binance-opens-crypto-withdrawals-in-phases-starting-with-bitcoin-following-usd6-3-billion-hack
- Decrypt Agent, "Binance Sets Aside $6.34B to Cover Hack Losses, CEO Says 'Your Assets Are Safe'," Decrypt, Oct. 30, 2026, https://decrypt.co/382237/binance-sets-aside-6-34b-to-cover-hack-losses-ceo-says-your-assets-are-safe
- "Binance restores USDC, USDT, ETH, and BNB withdrawals after hot wallet breach," Crypto Briefing via TradingView, Nov. 1, 2026, https://www.tradingview.com/news/cryptobriefing:b0d33f774094b:0-binance-restores-usdc-usdt-eth-and-bnb-withdrawals-after-hot-wallet-breach/
- Lookonchain, "The Binance hacker made a $5M mistake while dumping altcoins!," post on X, Nov. 1, 2026, https://x.com/lookonchain/status/2116746249097666777
- John Chen, "Binance hacker sells 908,793 PROM worth $5M for $71 on Uniswap V2," Crypto Briefing, Nov. 1, 2026, https://cryptobriefing.com/binance-hacker-sells-prom-71-uniswap/
- Davis Giangiulio, "Binance's $6.3 billion hack raises questions about crypto wallet safety," CNBC, Oct. 31, 2026, https://www.cnbc.com/2026/10/31/binance-hack-crypto-wallet-safety.html
- CoinGecko, "Binance Coin (BNB) price in US dollars," Nov. 1, 2026, https://api.coingecko.com/api/v3/simple/price?ids=binancecoin&vs_currencies=usd
- "He Yi: The address receiving 2,000 BTC is Binance's new wallet," TechFlow, Nov. 1, 2026, https://www.techflowpost.com/en-US/newsletter/142311
- Yi He, "That is a new Binance wallet address," post on X, Nov. 1, 2026, https://x.com/heyibinance/status/2116787190575579348
- Benjamin Njiri, "Binance says 95% of hack losses covered: Can users withdraw normally?," AMBCrypto, Nov. 1, 2026, https://ambcrypto.com/binance-says-95-of-hack-losses-covered-can-users-withdraw-normally/
- John Kim, "Binance Targets Nov. 2-3 ET for Full Zero-Knowledge Reserve Proofs," TokenPost, Nov. 1, 2026, https://www.tokenpost.com/news/business/45731