EL7.AI
CryptoMediumUpdated×2•Originally published 3 November 2026•Updated 3 November 2026•
4 min read

Binance Begins Second Phase of Withdrawals on Nov. 3 After $6.3 Billion Hack

Key Facts

1The second phase of withdrawals begins at 04:00 UTC on Nov. 3, 2026, following the first phase on Nov. 1, 2026.
2Binance estimated the hack's total impact at about $6.3 billion.
3Binance said it had covered about 95% of the affected amount, with 5% remaining for tokens outside the ten-token list cited.
4Binance reported that about $3 billion in on-chain assets had been frozen as of its Oct. 30, 2026 update.

Binance will begin the second phase of restoring withdrawals at 04:00 UTC on Nov. 3, 2026, after making selected assets and networks available in the first phase on Nov. 1, restoring more transfer options for users following a hack with an estimated impact of about $6.3 billion. The platform said in its announcement that withdrawals would return gradually as security and readiness checks are completed for each asset and network. The second phase covers assets on the BSC, ETH, SOL, XRP, SUI, Arbitrum, Optimism, TRX and Base networks. Listing these networks does not mean they will all become available at the same time; Binance said withdrawals would be reopened in stages. It added that deposit services remained open and were unaffected by the suspension.

Binance said it prioritized the return of tokens based on user demand during the week before the announcement, while warning of possible temporary delays or longer processing times because of transaction volumes. This means the timing of withdrawal resumption will vary by asset and network, even among those listed for the second phase. The platform asked users to check withdrawal status before making a transfer, as service restoration depends on completing security and operational checks for each route. It said processing pressure could lengthen the wait for some requests as service resumes. Binance is continuing to restore withdrawals while strengthening safeguards, with no single date for all assets to become available.

In an update issued on Oct. 30, Binance estimated the incident's total impact at about $6.3 billion and said the hack occurred at around 20:05 UTC on Oct. 29, targeting hot wallets. It said its initial investigation indicated a potentially compromised DevOps engineer's computer had enabled the attacker to access a service container and submit unauthorized withdrawal transactions. In a later update, it said the investigation had uncovered additional points of compromise and that it had found no evidence that private wallet keys had been leaked. It also said it would publish a technical review after the investigation was complete and the facts had been verified. As of its Oct. 30 update, the platform said about $3 billion in on-chain assets had been frozen.

In a Nov. 2 update, Binance said it had covered about 95% of the affected amount with its own funds, while the remaining 5% involved tokens outside the list of ten tokens it had presented. It described those tokens as less liquid and slower to source in the required volumes, explaining why part of the impact remained uncovered in that update. On Oct. 30, the platform had said it had allocated more than $6.34 billion in company funds to cover losses, including $5 billion in the affected assets themselves, and estimated at the time that the allocation covered about 80% of the amount. These updates show the coverage estimate rising from about 80% on Oct. 30 to about 95% on Nov. 2. Binance said in its Nov. 3 announcement that the company would absorb losses from stolen funds and users would not be charged.

Reuters reported that Bitcoin fell more than 4% on Thursday, Oct. 29, while Ether dropped more than 5%, before both assets recovered some of their losses on Friday. Binance said about $1.57 billion linked to the hack had been frozen, while Circle announced it had frozen $800 million, Reuters reported. At the industry level, the head of OKX called for an instant alert system that would allow participants to share information when a hack occurs, coordinate their response and temporarily freeze suspected funds. The head of Franklin Templeton's crypto division also said addressing the security situation was necessary immediately for the industry to reach its full potential. These moves place the restoration of withdrawals within a broader response to the incident, including securing assets and strengthening coordination among participants.

On next steps, Binance said it expected to publish additional technical findings about 48 hours after its Oct. 30 update, subject to verification and provided disclosure would not harm the ongoing investigation. It also confirmed in its Nov. 3 update that withdrawals would continue to resume while safeguards were strengthened, and that losses from stolen funds would not be passed on to users. The publication of the technical review remains contingent on completing the investigation and verifying the facts, according to the platform. Assets covered by the withdrawals are returning gradually after security and readiness checks are completed, with processing delays possible during the restoration period. Binance describes the resumption of withdrawals as ongoing work in its recovery from the incident.