Binance begins second withdrawal phase after $6.3B hack

Binance began a second round of withdrawal restorations at 04:00 UTC on Tuesday, Nov. 3. Within hours, it had reopened dozens more tokens on Ethereum ↗ 0.14% and Solana ↗ 0.83%. The world's largest crypto exchange is still rebuilding access to customer funds after what has been described as the biggest theft in crypto history.

Reuters, via The Economic Times, reported that the exchange announced the plan on Monday. The plan covers assets on BNB ↗ 0.76% Smart Chain, Ethereum, Solana, the XRP ↗ 0.75% Ledger and Sui ↗ 0.69%, with selected tokens on Arbitrum, Optimism, Tron and Base. "Like phase one, reopening will roll out progressively across the assets as security and readiness checks are completed," Binance said, according to Cointelegraph.cointelegraph.com+1

Tokens Coming Back Online

According to crypto.news, Binance confirmed on X that withdrawals had resumed for 31 more assets on Ethereum and 20 on Solana. These included Chainlink ↗ 1.65%, Shiba Inu ↗ 2.22%, Ondo and Bonk. An earlier update that day had restored five stablecoins on Ethereum, so 36 assets were reopened on that network on Tuesday. Binance has not set a completion date for the remaining assets. It says tokens are being prioritized by user demand over the past week, and that deposits were never suspended, ABP Live reported.crypto.news+1

On Monday, the exchange also reopened withdrawals in several fiat currencies, including the US dollar, UAE dirham and Vietnamese dong. That added to 23 currencies that were already available. Outflows have also slowed. DefiLlama data shows net outflows of $2.57 billion on Monday, down from $6.1 billion the day before, Cointelegraph reported. Binance warned customers about scammers offering paid "expedited" withdrawals. "Anyone promising to expedite it for a fee is scamming you," the exchange said.cointelegraph.com

Covering the Losses

The Oct. 29 attack drained hot wallets across 10 blockchains. Binance's initial investigation suggested a compromised DevOps engineer's laptop let the attacker submit unauthorized withdrawals. About $3 billion of the stolen funds has been frozen on-chain. Binance says it has now replaced about 95% of the affected assets using its emergency SAFU fund, futures insurance fund and corporate treasury, according to the BBC. The remaining 5% is in less liquid tokens that are taking longer to buy. When withdrawals first reopened on Nov. 1, customers pulled a net $3.64 billion.bbc.co.uk+1

North Korea Denies Involvement

The FBI has blamed the theft on TraderTraitor, a hacking group tied to North Korea. Pyongyang rejects the charge. Kim Yo Jong, Kim Jong Un's sister, called the US claim "a grave political provocation" and "absurd rhetoric and nothing new," according to state media cited by DW. The theft is far larger than the roughly $1.5 billion Bybit hack in 2025, which was also attributed to North Korean hackers.dw.com