Binance Reopens Withdrawals on Nine Networks After $6.3B Hack

Binance reopened withdrawals on at least nine blockchain networks by 5:48 a.m. ET Sunday, three days after a theft of about $6.3 billion from its hot wallets was announced.

Bitcoin went first. Early Sunday the exchange said on X that the bitcoin network was the "first batch" of phase one. Ethereum and BNB Smart Chain followed for ETH, BNB, USDT and USDC, and later posts added XRP, Base, Dogecoin, Optimism, Arbitrum and Tron, according to Binance's latest update. CNBC also reported the restart.

Withdrawals are the part customers can test for themselves. Binance said Saturday that it had replaced 90% of the stolen assets and that holdings of 10 coins, including BTC, ETH, USDT, BNB, SOL and XRP, are fully backed. Black Mint reported that pledge on Oct. 31.

Withdrawals now come from new addresses

A hot wallet is an exchange wallet kept online so it can sign customer withdrawals quickly. That speed is also what makes it a target. Binance said Sunday it has added newly generated addresses to its proof-of-reserves list, the public set of wallets anyone can check on-chain, and that all withdrawals will now be processed from them.

The refill is paid for out of three pots: SAFU, the exchange's emergency fund for users, part of its futures insurance fund and corporate treasury money, Binance said in a statement carried by CNBC. The missing 10% sits in tokens outside its top 10. Binance said those are less liquid and may take longer to buy.

What Binance hasn't said

The exchange still hasn't explained how the attacker got in. It first pointed to a compromised engineer's laptop; co-CEO Richard Teng later said the attack was more complex than one person's access, CNBC reported. Binance declined to give CNBC further details. The FBI said Saturday that North Korea was responsible.

The Solana network was not on Binance's list of reopened networks as of 5:48 a.m. ET. Its posts gave no date for the rest, saying only that more networks will return in phases as security checks finish.

In our opinion: a working withdrawal button is a promise customers can check in their own wallets. The next tests are the networks still closed, including Solana, and the last 10% held in smaller tokens. Watch Binance's next recovery update for both, and for an account of how the attacker got in.