Binance Restarts Withdrawals in Phases After $6.3 Billion Crypto Hack, Says 95% of Stolen Funds Have Been Covered

Binance has started reopening user withdrawals after the $6.3 billion crypto hack, with phase one running between 11:00 AM and 02:00 PM PKT. The exchange says it has now covered 95% of the stolen assets, up from 90%, while deposits remained open throughout.

1. The first withdrawal phase is limited to specific tokens, selected using user demand data from the past week. Binance says the rollout is being done in stages so the security team can restore access without destabilizing the platform.
2. The assets available in phase one are split by network: BTC on BTC; ETH and USDT and USDC on ETH; BNB, USDT and USDC on BSC; TRX and USDT on TRX; SOL, USDT and USDC on SOL; XRP on XRP; ZEC on ZEC; DOGE on DOGE; USDT and GRAM on TON; POL, USDT and USDC on MATIC (Polygon); AVAX, USDT and USDC on AVAXC; ETH, USDT, USDC and ARB on ARBITRUM; ETH and USDC on BASE; ETH, USDT and USDC on OP (Optimism); and SUI on SUI.
3. Binance warned that users may see temporary delays because of high traffic volumes. If a transaction fails, the company says users should try again after a short wait. Deposits were not affected by the incident and remain fully open.
4. The company says it is still buying the remaining affected assets through market and over-the-counter (OTC) channels. The outstanding 5% consists of less liquid tokens outside the top ten assets, which take longer to source at scale.
5. Binance says balances for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are 100% backed, and users can verify reserves on its Proof of Reserves (PoR) website. The exchange also says it will absorb the full financial impact of the security incident and not pass losses on to users.

For high-risk operators and PSPs, the practical takeaway is familiar: even when a venue can keep deposits live, withdrawal controls can tighten fast, and asset coverage may return in stages rather than all at once. Binance says it paused withdrawals to contain the incident, assess impact, complete security checks, and work with law enforcement and industry partners to trace the stolen funds.