Binance Reopens Stablecoin Withdrawals After $6.3B Hack

Binance restores USDT, USDC, ETH and BNB withdrawals on Ethereum and BSC

Binance has resumed withdrawals for USDT, USDC, ETH and BNB across the Ethereum network and BNB Smart Chain (BSC), reopening stablecoin and native token transfers that had been suspended after the October 29 exploit that siphoned roughly $6.3 billion. The exchange announced the phased restoration on November 1 as part of a wider recovery plan following the major security incident.

Networks and assets now available

Customers can currently withdraw the following assets on the listed networks:

• Ethereum network: USDC, USDT, ETH
• BNB Smart Chain (BSC): USDC, USDT, BNB

Binance emphasized this is a phased reopening; other networks and tokens remain blocked while security teams complete forensic checks and wallet reconciliations. The exchange previously prioritized Bitcoin withdrawals, which were restored in an earlier window on Sunday before stablecoin access was re-enabled.

Phased recovery and liquidity management

The staged approach allowed Binance to validate the integrity of each network before enabling outbound transfers. Initial recovery windows were scheduled early Sunday, with the exchange identifying multiple networks for sequential security audits. Binance said the reactivation of Ethereum and BSC now gives users renewed access to the two most widely used dollar-pegged stablecoins for cross-platform transfers.

Binance has not published immediate figures for how much USDT or USDC left the platform after withdrawals reopened. Distinguishing between customer-initiated withdrawals and internal liquidity movements will require blockchain-level analysis, as exchanges commonly redistribute funds among their own wallets to manage operations. Deposits remained available during the incident, letting users continue adding funds to accounts while withdrawals were gradually reinstated.

Remaining networks and timelines

The company warned that additional assets and networks will be brought back online in phases. Security teams and external partners continue to audit hot wallets, verify transaction provenance, and ensure there are no residual threats before broadening withdrawal access.

Asset recovery and proof of reserves

Binance says it has replenished about 95% of assets affected by the October 29 attack. Earlier statements from the company tracked a recovery trajectory from 80% to 90% and now to 95%, leaving roughly 5% of losses still being replaced. The remaining shortfall consists mostly of lower-liquidity tokens that Binance is acquiring through open exchanges and over-the-counter trading desks.

The exchange reported full backing for many major balances, including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. To cover the incident, Binance previously earmarked $6.34 billion of its corporate resources, tapping reserves such as the Secure Asset Fund for Users, portions of the company treasury, and part of its Futures Insurance Fund. Binance has repeatedly stated that customers will not shoulder the loss.

Binance published an updated Proof of Reserves snapshot taken at 00:00 UTC on October 31. The company indicated it will release a full zero-knowledge proof by November 3 to enable users and auditors to independently verify account backing and liquidity positions.

Recovery mechanics and risk management

Recovering difficult-to-price or low-volume tokens requires careful market engagement to avoid disrupting prices. Binance's stated approach combines OTC buys and exchange purchases to replenish its holdings while minimizing market impact. Meanwhile, security teams continue to monitor on-chain flows and coordinate with analytics firms to trace and freeze suspicious addresses where possible.

Law enforcement, attribution and geopolitical response

The resumption of withdrawals coincides with heightened law enforcement involvement. The FBI issued an alert attributing the theft to North Korea-linked cyber actors known as TraderTraitor, reporting that attackers converted stolen value predominantly into Ethereum and were likely to use decentralized finance protocols and instant-swap services to obscure proceeds. The FBI, Secret Service and IRS Criminal Investigation called on industry participants to block transactions associated with addresses tied to the attackers.

U.S. President Donald Trump said he was monitoring the situation and would address the matter with North Korea if attribution to the state is confirmed. Speaking at his Mar-a-Lago residence, Trump said investigators were looking into the breach and indicated he would discuss any state-level involvement directly.

Blockchain tracing efforts have followed stolen funds across multiple networks, including Ethereum, Bitcoin and Tron, while Binance continues to assist global law enforcement and industry partners in attempts to freeze or recover assets. The exchange is also working with token issuers and analytics firms to identify suspect flows and coordinate mitigation steps.

What this means for users and the market

For users, the immediate significance is practical: the two most-used stablecoins for transfers between platforms — USDT and USDC — are operable on Ethereum and BSC, restoring pathways for withdrawals and inter-exchange settlement. The restoration should ease liquidity frictions for traders and institutions that rely on stablecoin rails for rapid fund movement.

However, investors should remain cautious. Ongoing audits, wallet sweeps and on-chain analytics will continue to shape which networks reopen next and how quickly remaining assets are restored. Market participants should track official statements from exchanges, blockchain analytics providers, and law enforcement to confirm address blacklists and sanctioned flows.

Security lessons and industry implications

The incident reinforces persistent security challenges for centralized exchanges, including the need for robust key management, multi-party computation, and layered emergency response plans. Exchanges may face increased scrutiny from regulators and counterparties, and users may accelerate diversification strategies such as maintaining funds in hardware wallets or using multiple custodial providers.

Looking ahead

Binance has pledged ongoing transparency, promised a detailed incident report, and expects to publish its full zero-knowledge proof by November 3. As the exchange completes purchases to fill the remaining gaps, it will continue to reopen networks in a controlled manner informed by security assessments and law enforcement collaboration.

Users should monitor official exchange channels and trusted blockchain analysis feeds for updates on additional network reopenings, wallet blacklists, and the formal incident report. The broader crypto ecosystem will be watching how quickly and comprehensively Binance can normalize operations and restore confidence in exchange custody practices.