Binance aimed to reopen customer exits within days of the largest exchange theft on record, and a phased reopening did begin on Sunday, November 1, 2026. TechCrunch reported that the exchange paused withdrawals as hackers were suspected of stealing billions in crypto. By Saturday, October 31, 2026, the question for millions of account holders had shifted from “what happened” to “when can I move my coins.” Co-founder He Yi said withdrawals were expected to resume within 48 hours, and a separate report described the target as Sunday, the day the first phase started.

That restart began as a target and became a phased reality: Binance started restoring withdrawals on Sunday, November 1, 2026, though its official updates continued to describe restoration as gradual and conditional on security checks. Binance withdrawals resume headlines circulated widely, and this analysis separates what the exchange said from what outlets inferred. We start with the entry point. Our earlier look at the reported DevOps laptop entry point covers how investigators think the intruder got in, and that detail matters for any restart plan.

The numbers are large and they kept moving. Binance put affected losses at roughly $6.3 billion and said about $3 billion had been frozen on blockchain networks. It also said deposits kept working and that it would cover all hacking losses, and on November 12, 2026 it said it had fully covered the assets affected by the cyberattack. Below, we walk through the timeline, the loss and freeze math, the security work a restart demands, what rivals are doing, and five predictions for the restart weekend.

Add Shattered once in the Google app and our stories show up in your news suggestions.

What Binance Has Actually Said About Resuming Withdrawals

Start with the primary statements. Binance reported a security incident involving unauthorized withdrawal transactions on October 30, 2026. It temporarily suspended withdrawals while security checks ran, and it told customers that deposits were operating normally. Ross O’Leary, a Binance spokesperson, said the exchange had “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.”

On timing, the language is hedged. He Yi, Binance’s co-founder, said withdrawals were expected to resume within 48 hours. CNN reported that Binance expects withdrawals back by Sunday morning. Those two statements are consistent if the clock started Friday, but neither was a guarantee. Binance had not published an exact time beforehand, and the cited reports described an operational target. The reopening then began in phases at 06:00 GMT on Sunday, November 1, 2026, which delivered a first tranche on the Sunday goal rather than a full return.

The exchange also tied the restart to testing. Reports said withdrawals must pass rigorous security testing before services return. That framing gives Binance room to slip the schedule without calling it a failure. If a test fails, the date moves. Users should read “within 48 hours” as a best case that depends on engineers signing off, not as a promise from the legal or compliance side.

One more point on language. Binance has used the phrase “user funds are safe” repeatedly, and it has paired that with a pledge to absorb losses. The pledge matters for customers, but it does not change the mechanics of a restart. Cash-out rails still need to be rebuilt in a way that stops a second incident, and that work happens in infrastructure, not in press statements.

Timeline of the Binance Hack From Oct. 29 to Oct. 31

The sequence moved fast. Bloomberg’s October 29 report carried a headline saying a Binance founder raised the possibility of a hack and that Bitcoin fell. A day later Binance described a security incident involving unauthorized withdrawal transactions and paused outflows. The table below pulls the dated points from the fact sheet and the cited coverage.

Note the compression. From first public concern to a stated recovery target took roughly two days. That pace reflects how much pressure an exchange faces when customer balances sit behind a closed door. It also raises a fair question about how thoroughly any system can be tested in 48 hours after a breach of this size.

For a minute-by-minute view of the theft itself, see our explainer on the 20-minute, 10-chain heist. It shows why Binance suspended withdrawals on multiple networks rather than one.

The $6.3 Billion Figure and Why Estimates Differ

The Record from Recorded Future News called it a record $6.3 billion crypto hack as Binance scrambled to freeze funds. The $6.3 billion figure is the preliminary estimate of affected losses. Other outlets reported lower initial ranges, with some putting the observed theft between $5.6 billion and $6 billion. Tom’s Hardware used the $5.6 billion number in its headline while noting that stablecoin networks moved to freeze about $2.4 billion.

Why the spread? Early tallies track wallets that a tracing firm has flagged, while the exchange’s own number reflects affected assets across its systems. Prices also move. A basket of tokens valued at one hour can change by billions the next hour. Our own piece on four competing loss estimates tracked this problem as it developed.

The last row is the one to remember. The exact amount stolen has not been confirmed. Every other number in the table is an estimate, a freeze claim, or a reserve. Readers who treat $6.3 billion as a settled total are getting ahead of the facts.

How the $3 Billion Freeze Shapes the Restart

Binance said approximately $3 billion had been frozen on blockchain networks. That is roughly half of the $6.3 billion estimate, and it changes the restart math in two ways. First, it limits how much the exchange must replace from its own balance sheet. Second, it creates a recovery workflow that runs on its own clock, because frozen assets must still be released or returned through the issuers and networks that froze them.

Stablecoin issuers did much of the heavy lifting. Reports said they froze around $2.4 billion in USDT, USDC and RLUSD tied to the suspected attacker’s wallet. A freeze works on tokens that a central issuer controls. It does nothing for assets such as Bitcoin that no issuer can lock. We broke down the split in our piece on who froze what between Tether and Circle.

For the weekend restart, the freeze matters because it shrinks the attacker’s ability to cash out. Less movable value means less urgency to drain remaining exposure, though Binance has not said the threat is over. The exchange engaged law-enforcement and blockchain-intelligence partners to trace and recover funds, and that effort continues while the withdrawal pipes reopen.

The DevOps Laptop Entry Point and What a Restart Requires

Binance’s preliminary read is that a compromised DevOps engineer’s laptop enabled access to a service container. Reports also said investigators found no evidence that wallet private keys had been leaked. PCMag was among the outlets relaying that detail. Taken together, the picture is an intrusion through a human endpoint into automated infrastructure, rather than a cryptographic break of the wallets.

Why a restart is harder than an unlock

If a service container was reachable from a developer laptop, the restart cannot simply flip a switch. Engineers have to rebuild the trust chain around that container. Binance said it revoked authorization for the affected address, which is one visible step. Other steps are likely to include rotating credentials, auditing what the container could reach, and tightening who can approve withdrawals. Binance has not published that list, so treat it as expected practice, not confirmed action.

The testing gate

Reports said withdrawals must clear rigorous security testing first. A sensible test plan reopens small, watches closely, and scales up. If Binance restarts in stages, some networks or asset types could return before others. That pattern would fit the original pause, which hit multiple networks at once. Our developer-focused write-up of five developer lessons from the heist lays out the controls that most directly address this kind of path.

Binance Withdrawals Resume: Confirmed Versus Unconfirmed

With so many numbers circulating, a plain scorecard helps. The table sorts the main claims into what the fact sheet confirms and what remains open. Use it to judge any headline you see this weekend.

The unconfirmed rows share a pattern. Each one depends on an investigation or a test that has not finished. That is normal for an incident that is still under investigation, but it argues for patience with any headline that states a full restoration as settled. The takeaway: follow Binance’s own announcements, which describe withdrawals as being restored in phases.

How the Phased Reopening Unfolded

Binance began restoring withdrawals in phases at 06:00 GMT on Sunday, November 1, 2026, initially prioritizing networks and tokens after security checks. The first phase included BTC, ETH, USDT, USDC, DOGE, TRX, ARB, AVAX, POL and other assets across 15 networks. U.S.-dollar cash withdrawals resumed on November 2, with additional networks reopening in stages.

Binance’s Security Incident Recovery Update #6, dated 2026-11-03, said that following the successful resumption of withdrawals for some networks and assets in Phase 1 on November 1, 2026, Binance would gradually reopen withdrawals for more assets starting at 12:00 (UTC+8) on November 3, 2026. Update #8, dated 2026-11-05, said withdrawals for further assets would gradually reopen starting at 12:00 (UTC+8) on November 5, 2026. Between November 3 and 6, 2026, Binance progressively reopened withdrawals across more assets and networks after security checks. Between November 1 and 12, 2026, restoration also reached Solana, Polygon, Avalanche, Arbitrum, Tron, Optimism and Dogecoin, while other routes remained subject to security checks.

The latest official Binance announcement was updated on November 13 and still described withdrawals as being enabled gradually, rather than declaring a universal return to normal. Reporting on November 12, 2026 said the initial withdrawal rush was slowing, although Binance still faced customer concern about the exchange’s security. For readers, the November 1 list was only the initial phase and is not the complete list of assets available now, so check the official announcements for your specific asset and network before planning a transfer.

Loss Coverage and the Reserve Math Behind the Pledge

Binance pledged to cover all user losses using company funds and its emergency assets fund. On November 12, 2026, it said it had fully covered the assets affected by the cyberattack, using its SAFU fund, its futures insurance fund, corporate treasury, and purchases of affected cryptocurrencies, and that it committed more than $6.34 billion to replace them. That sum sits just above the $6.3 billion loss estimate, which is the point of the number. A reserve larger than the headline loss tells customers the exchange intends to be solvent even if the full estimate proves accurate. We ran the arithmetic in our piece on the $6.34 billion reserve math.

Two caveats apply. A reserve is a commitment, not cash delivered to individual accounts. And the freeze of about $3 billion could offset some of the cost if those assets come back. The coverage claim is a company statement, not an independently verified proof of all user-asset balances, although Binance reported a cryptographic proof-of-reserves snapshot dated October 31. The pledge reduces the odds of customer losses, but it does not remove the need to see the audit trail.

The structure resembles an insurance claim in reverse. The company absorbs first, then tries to recover from the thief. If recovery falls short, the shareholder-equivalent takes the hit. For users, that ordering is the favorable one. For Binance, it means the restart date has a financial edge: the longer exits stay closed, the longer confidence erodes.

Statements From Binance Leaders, Checked

Several lines from Binance have been widely repeated. We checked each against the source material and quote only what appears word for word.

• CNN carried the Binance statement “User funds are safe.” The line followed the decision to suspend deposits and withdrawals after the reported hack.
• A Binance service update on its Square channel said “We expect to resume within 48 hours.” The update explained that withdrawals were paused during a security overhaul.
• He Yi, Binance’s co-founder, wrote on Binance Square: “Deposits are operating normally; withdrawals expected to resume within the next 48 hours.”
• He Yi also said: “User funds are safe. Binance will cover all hacking losses.”
• Ross O’Leary, a Binance spokesperson, said Binance had “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.”

Read closely, none of these quotes guarantees a clock time. “Expect” and “expected” are the operative verbs. The statements also stop short of naming a cause beyond the preliminary entry point. If you see a headline that claims Binance promised a Sunday restart, it overstates the wording above. Our earlier review of five Zhao quotes on the hack applied the same test to another set of comments.

InvestingLive framed the same pledge in its headline as Binance halting deposits and withdrawals while promising to cover all losses from a suspected hack. That framing matches Binance’s own wording and adds the word “suspected,” which signals how early the investigation was when the exchange first spoke.

Market Impact on Bitcoin, Tokens and Exchange Rivals

Markets reacted before the facts settled. Bloomberg’s headline on October 29 tied the possible hack to a drop in Bitcoin. Exchange failures tend to hit sentiment hard, because the largest venue sets the tone for the whole sector. Our coverage of the sell-off in Bitcoin’s six-week low and the liquidations follows the price side in more detail.

The restart eased one pressure point, though exits came fast: Binance reported that between 06:00 and 15:30 GMT on November 1, 2026, it processed approximately $4.649 billion in withdrawals and $1.01 billion in deposits, a net outflow of about $3.64 billion. Frozen exits trap sellers and buyers alike, and when the doors reopen, pent-up orders can move prices in either direction. Traders who held positions on Binance during the pause could not hedge elsewhere with the same collateral. That makes the first hours after reopening volatile by default, whatever the news says.

Rivals face a mixed picture. Customers may move some funds to competing venues, but those venues are also scrutinized for the same weak points. The shared lesson is that a single compromised endpoint can threaten a large balance sheet. We covered how rival exchanges tightened defenses in the days after the heist.

Competitive Comparison: How Exchanges Handle Incident Recovery

Exchanges differ in how they prepare for a day like this. Some keep a dedicated insurance or emergency fund. Some rely on cold storage to keep most assets offline. Others lean on proof-of-reserves reporting to reassure users. Binance has a mix, including the emergency assets fund it said it would draw on, plus a freeze-and-trace response with outside partners.

What separates a good response from a poor one is speed of disclosure and clarity of the restart rule. Binance disclosed within a day and set a window within two. It did not give a single confirmed time. For a side-by-side look at how five platforms stack up on safeguards, see our exchange security scorecard.

The scorecard idea applies here. Users should ask four questions of any venue: how much sits in hot wallets, who can approve large withdrawals, how developer machines connect to production, and what happens when something breaks. The Binance case tests the third question more than the first two, since the entry point was a developer laptop rather than a stolen key.

Historical Context: From Bybit to the Binance Hack

Exchange breaches are not new, but the scale here is. Our record ladder of the biggest crypto hacks shows the Binance figure at about four times the Bybit theft that previously held the top spot. That gap makes this incident an outlier even in a field built on large numbers.

Attribution adds another thread. The FBI formally attributed the Binance theft to TraderTraitor, a North Korean group, on October 31, 2026, and said the attackers were converting stolen assets, primarily into Ether, to launder them. North Korean officials denied responsibility, which is a reported position, not independent confirmation, and the technical investigation remained ongoing. TRM Labs was among the firms making the North Korea case earlier, and we summarized its view in our report on TRM’s attribution to TraderTraitor. State-linked groups have a record of targeting developers and infrastructure, which would fit the reported DevOps laptop entry point, but fit is not proof.

Past restarts offer a pattern. After large exchange breaches, the best-run companies pause outflows, fix the root cause, reopen in stages, and publish a post-mortem. The worst-run ones go quiet. Binance chose the first path, and the phased restart that began on Sunday, November 1, 2026 was the next checkpoint in that process.

Five Predictions for the Restart Weekend

These are analyst judgments, not reported facts. They rest on the statements above and on how past incidents played out.

• A staged restart beats a full reopening. Given the reported testing gate and multi-network pause, Binance is more likely to bring back some assets or networks first than to flip every route at once.
• The Sunday target did not slip by days. Binance began restoring withdrawals in phases at 06:00 GMT on November 1, 2026. A short delay for testing would have fit the expect language. A multi-day slip would have signaled a deeper problem.
• Early volume spikes. Pent-up orders and exits created heavy traffic in the first hours. Binance reported about $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 GMT on November 1.
• Attribution firms up before the final loss number does. Tracing work tends to move faster than the full accounting, so more investigator reports may land before a confirmed stolen total.
• A published post-mortem follows within weeks. Pressure from regulators and users usually forces a technical write-up after a breach this size, and the DevOps path is the obvious focus.

The most likely failure mode is a rushed reopening followed by a second pause. That would damage trust more than a late but clean restart. If Binance has to choose, a slower, verified reopening is the better call, and the company’s own language about rigorous testing suggests it knows this.

What Users Should Do Before Withdrawals Reopen

Yahoo Finance ran a practical piece on what Binance users should do right now. The advice fits the situation. Do not rush to withdraw, since traffic can be heavy and phishing tends to spike. Check the official Binance announcement channel for updates on which assets are being restored, and ignore messages that arrive through email or direct messages claiming to offer faster access.

• Confirm that withdrawals are live from Binance’s own announcement, not from social posts.
• Review withdrawal address whitelists and remove any you do not recognize.
• Turn on or re-check two-factor authentication and anti-phishing codes.
• Test with a small transfer before moving a large balance.
• Be wary of anyone who contacts you offering recovery help for a fee.

The last point deserves emphasis. Scammers follow every major breach, and a restart is their best window. Address-swapping tricks also surface when traffic jumps. Our walkthrough on building an address poisoning guard shows how to protect transfers at the code level. For broader context on defensive practice, browse the security section of the site.

FAQ: Binance Withdrawals and the Weekend Restart

Have Binance withdrawals resumed yet?
Partly. Binance co-founder He Yi said withdrawals were expected within 48 hours, and CNN reported a Sunday morning goal. Binance began restoring withdrawals in phases on Sunday, November 1, 2026, and its latest official announcement, updated on November 13, still described withdrawals as being enabled gradually. Check Binance’s own announcement for your asset and network.

How much did Binance lose in the hack?
Binance and outlets such as Bloomberg and The Record put affected losses at about $6.3 billion. Some early reports gave a lower range of $5.6 billion to $6 billion. The exact amount stolen is unconfirmed.

Are my funds safe on Binance?
Binance says user funds are safe and that it will cover all hacking losses. On November 12, 2026, it said it had fully covered the affected assets and committed more than $6.34 billion to replace them. That is a company claim, and independent verification of the final accounting is still pending.

Can I still deposit while withdrawals are paused?
Binance said deposits were operating normally and were unaffected. Only withdrawals were suspended during the security checks.

How did the attacker get in?
Binance’s preliminary read is that a compromised DevOps engineer’s laptop enabled access to a service container. Reports said investigators found no evidence that wallet private keys had leaked. The preliminary finding could change as the investigation continues.

Who is behind the Binance hack?
The FBI formally attributed the theft to TraderTraitor, a North Korean group, on October 31, 2026. North Korean officials denied responsibility, and the technical investigation remained ongoing.

How much money has been frozen?
Binance said approximately $3 billion had been frozen on blockchain networks. Separate reports said stablecoin issuers froze around $2.4 billion in USDT, USDC and RLUSD tied to the suspected attacker’s wallet.

What should I do while withdrawals are being restored?
Withdrawals reopened in phases on November 1, 2026, and Binance is restoring more assets gradually. Confirm the status of your asset on Binance’s official channel, test with a small transfer, and watch for phishing messages. Avoid rushing, since heavy traffic and phishing attempts are likely.