Binance to Resume Customer Withdrawals in Phases After Reported Hack

Binance has reportedly begun restoring customer cryptocurrency withdrawals in phases after a major security incident involving approximately $6.3 billion in assets. Bitcoin withdrawals were among the first services reported to resume, while later coverage said Ether withdrawals had also become available.

The reported reopening follows a period during which customers faced restricted or suspended access to cryptocurrency transfers. A phased approach allows Binance to monitor wallet infrastructure, liquidity, transaction processing, account controls, and unusual blockchain activity before restoring additional assets and networks.

Reuters reported that Binance resumed Bitcoin and Ether withdrawals after covering most of the reported losses. CoinDesk separately reported that the exchange began reopening withdrawals with Bitcoin. However, the reported $6.3 billion loss, the percentage of replaced assets, and the suspected identity of the attackers should not be treated as independently verified without further official or investigative confirmation. Source 1

What Happened in the Reported Binance Hack?

Reported $6.3 Billion Incident

Several reports described the event as a major hack involving Binance-held or customer-related cryptocurrency assets. Reuters referred to approximately $6.3 billion in stolen assets, while Investing.com described the event as a record-scale hack involving roughly $6 billion. Source 5

The available summaries do not provide a complete technical account of the incident. They do not establish the precise attack vector, affected wallets or networks, breach duration, or whether every reported loss was independently confirmed on-chain.

“Assets stolen,” “assets replaced,” and “withdrawals resumed” describe different developments. Stolen assets are funds allegedly transferred by an attacker. Replaced assets may refer to customer balances restored by the exchange. Resumed withdrawals refer only to service availability.

Suspected North Korean Attribution

France 24 reportedly linked the attack to North Korea, but described the connection as alleged. The attribution therefore remains a claim rather than a confirmed conclusion in the available material. Source 7

Cyberattack attribution can change as investigators examine wallet movements, malware, infrastructure, exchange deposits, and laundering patterns. The suspected connection should remain clearly labeled until supported by an official investigation or detailed technical evidence.

Why Withdrawals Were Suspended

An exchange may pause withdrawals after a security incident to prevent unauthorized transfers and protect remaining assets. The suspension can give security teams time to:

• Secure hot and cold wallets
• Review wallet permissions
• Reconcile customer balances
• Investigate account and transaction activity
• Test withdrawal controls
• Monitor connected blockchain addresses
• Confirm that internal systems operate normally

Reopening withdrawals addresses operational access but does not resolve every question about the original incident.

Binance Reopens Withdrawals in Phases

Bitcoin Withdrawals Reportedly Resume First

CoinDesk reported that Binance began reopening cryptocurrency withdrawals in phases, starting with Bitcoin. Source 3

Bitcoin may receive priority because of high customer demand, extensive wallet infrastructure, liquidity, and established transaction monitoring. However, resumed Bitcoin withdrawals do not necessarily mean that every customer has unrestricted access. Availability may depend on account status, location, security reviews, limits, network conditions, and internal controls.

Ether Withdrawals Also Reported as Available

Reuters coverage said Binance resumed both Bitcoin and Ether withdrawals after covering most of the reported losses. Source 1

Other assets and networks may return only after wallet security checks, balance reconciliation, network monitoring, and internal approval. Availability may vary by cryptocurrency, network, account, jurisdiction, compliance status, and temporary risk controls.

Customers should verify current status inside the official Binance platform rather than relying on headlines or third-party posts.

Why Binance Is Using a Phased Reopening

A phased reopening can limit the impact of a new technical or security issue. It allows Binance to:

1. Monitor abnormal transaction activity.
2. Validate wallet controls asset by asset.
3. Reduce pressure on withdrawal infrastructure.
4. Confirm liquidity and balance records.
5. Manage customer support requests.
6. Suspend a specific asset or network without stopping all withdrawals.

This signals controlled restoration, not proof that the incident has been fully resolved.

Customers may still encounter processing delays, additional identity verification, withdrawal limits, suspended assets or networks, manual reviews, maintenance, or changing network fees.

Reported Recovery and Asset Replacement

The Times of India reported that Binance claimed to have replaced 95% of affected assets. Source 9

The 95% figure remains attributed to that report and Binance’s reported statement. It has not been independently verified in the supplied material.

Replacing customer balances differs from recovering stolen cryptocurrency. An exchange may restore balances using company reserves, insurance, or other resources even if investigators cannot recover every asset transferred by an attacker.

Future official updates should clarify the incident timeline, asset and network availability, withdrawal limits and fees, customer compensation, security improvements, independent investigations, and changes to wallet and account controls.

What Customers Should Do Before Withdrawing

Check the Asset and Network

Confirm that the cryptocurrency and selected blockchain network are supported by the receiving wallet. Networks supporting the same asset are not necessarily interchangeable.

Before confirming a transfer, check the minimum withdrawal amount, network fee, estimated processing time, supported network, destination compatibility, address format, and account-specific limits.

Make a Small Test Withdrawal

When appropriate, send a small test amount before transferring the full balance. Confirm that the address and network are correct, wait for the transaction to appear, and receive the required confirmations before sending more funds.

Secure the Account

Customers should enable two-factor authentication, use a strong and unique password, set an anti-phishing code, enable withdrawal address allowlisting where appropriate, review login activity and active sessions, audit API keys, revoke unknown keys, remove unfamiliar devices, and update account recovery information.

Never share a password, authentication code, private key, or wallet recovery phrase with anyone claiming to represent Binance.

Watch for Phishing

A major exchange hack creates opportunities for impersonation scams. Attackers may claim that customers must complete emergency verification, pay a recovery fee, or connect a wallet to restore withdrawals.

Avoid emergency withdrawal links, recovery-fee requests, fake support accounts, seed-phrase requests, unofficial verification forms, remote-access software, and unsolicited recovery services. Access Binance through the official URL or verified application.

Record Transaction Details

Save the withdrawal confirmation, transaction ID, destination address, selected network, amount, fee, and timestamp. These records can help resolve delayed transfers or support requests.

What the Incident Means for Exchange Security

Restored withdrawals demonstrate operational progress but do not prove that every security issue has been fixed. Customers should distinguish between service restoration, asset replacement, root-cause analysis, attacker attribution, long-term security improvements, and independent investigation.

Proof of reserves can show the assets an exchange holds at a particular time, but it does not necessarily reveal wallet access controls, internal permissions, third-party exposure, operational procedures, cybersecurity weaknesses, key-management practices, or incident-response readiness.

Exchange custody also carries platform, operational, regulatory, and cyber risks. Customers may reduce counterparty exposure by keeping only active trading funds on an exchange and considering self-custody for other assets. Self-custody creates separate risks: a compromised device, lost private key, or misplaced recovery phrase can cause permanent loss.

Timeline

• Security incident: Reports described a Binance hack involving approximately $6.3 billion in assets.
• Withdrawal suspension: Binance reportedly paused or restricted withdrawals while reviewing systems, wallets, and balances.
• Initial reopening: Bitcoin withdrawals reportedly resumed first.
• Further reopening: Reuters reported that Ether withdrawals also resumed, with other assets expected to return in phases.
• Recovery statement: Reports said Binance covered most affected losses. The Times of India cited a Binance claim that 95% of affected assets had been replaced.
• Attribution: France 24 reported a suspected North Korean connection, but the available summaries do not establish definitive attribution.
• Current status: Customers should verify live availability through official Binance channels because access can vary by asset, network, account, and location.

Key Takeaways

• Binance reportedly began reopening customer withdrawals in phases after a major hack.
• Bitcoin was among the first assets reported to become available.
• Reuters coverage also reported resumed Ether withdrawals.
• The reported $6.3 billion loss and 95% replacement figure require clear attribution.
• The suspected North Korean connection remains an attribution claim.
• Customers should verify the asset, network, fees, limits, and destination address before withdrawing.
• A phased reopening indicates controlled restoration, not the end of all investigations or security concerns.

FAQ

When did Binance resume customer withdrawals?

Reports said Binance began restoring withdrawals in phases, with Bitcoin among the first assets to become available. Reuters also reported resumed Ether withdrawals. Exact availability may vary by asset, network, account, and jurisdiction.

Which cryptocurrencies can Binance customers withdraw?

The cited reports specifically mention Bitcoin and Ether. They do not provide a complete list of supported assets or networks. Customers should confirm availability inside the official Binance platform.

How much did the Binance hack reportedly cost?

The incident was reported as involving approximately $6.3 billion in stolen assets. The supplied summaries do not provide a complete independent breakdown, so the figure should be described as reported.

Did Binance replace customer funds?

Reports said Binance covered most affected assets. The Times of India cited a Binance claim that 95% had been replaced. This may refer to restored customer balances rather than recovery of every stolen cryptocurrency.

Was the Binance hack linked to North Korea?

France 24 reported an alleged North Korean connection. This remains a suspected attribution based on the available summaries and may change as investigators review technical and blockchain evidence.

What should customers do before withdrawing from Binance?

Confirm the asset and network, review fees and limits, verify the destination address, and consider a small test transaction. Secure the account with two-factor authentication and ignore emergency withdrawal messages.