Binance started restoring customer withdrawals in phases on Sunday, Nov. 1, more than two days after suspending the service following a security breach that compromised hot wallets and resulted in an estimated $6.3 billion loss.

The first phase opened between 1 a.m. and 4 a.m. ET, equivalent to 06:00 to 09:00 UTC. Bitcoin withdrawals became available shortly after the window began. The exchange said access would return gradually as security and stability checks were completed for each asset and network, so not every route opened simultaneously.

First-Phase Networks and Assets

The initial group covers 15 networks selected according to user withdrawal demand over the preceding week. Assets and networks in the first phase include Bitcoin on the Bitcoin network; Ether, USDT and USDC on Ethereum; BNB, USDT and USDC on BNB Smart Chain; TRX and USDT on Tron; SOL, USDT and USDC on Solana; XRP on the XRP Ledger; ZEC on Zcash; DOGE on Dogecoin; USDT and GRAM on TON; POL, USDT and USDC on Polygon; AVAX, USDT and USDC on Avalanche; ETH, USDT, USDC and ARB on Arbitrum; ETH and USDC on Base; ETH, USDT and USDC on Optimism; and SUI on Sui.

Additional networks and assets will reopen later once checks are finished. Binance warned that heavy traffic at the start of the process could produce temporary delays or failed attempts, and advised users to try again later if necessary. Deposit services remained open throughout the incident and were unaffected.

Recovery Progress and Reserve Backing

By the time withdrawals resumed, Binance reported it had replenished approximately 95 percent of the affected assets, an increase from the 90 percent figure in its previous update. The remaining portion consists mainly of lower-liquidity tokens that the exchange continues to acquire through market purchases and over-the-counter channels.

Customer balances in 10 assets are fully backed at 100 percent: Bitcoin, Ether, Tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD and Zcash. Users can review reserve snapshots on the exchange’s proof-of-reserves page. Binance stated it had allocated roughly $6.34 billion from its Secure Asset Fund for Users, futures insurance fund and corporate treasury to cover the shortfall.

The hot-wallet compromise occurred at approximately 4:05 p.m. ET on Oct. 29. The exchange said it would publish a full post-incident report after completing its investigation. As part of the response, it updated its list of proof-of-reserves addresses to include newly generated wallets, from which future withdrawals will be processed. Cryptographic verification of the latest snapshot is expected to finish by Nov. 3.

Ongoing Measures

Binance described the resumption as a controlled, phased process designed to restore access only after each network and asset pair passed readiness checks. The company reiterated that user funds remain safe and that covering all losses tied to the stolen assets remains its commitment.