Binance sets phased withdrawals after $6.3bn hack

Binance plans to begin reopening crypto withdrawals in phases on Sunday, after hackers stole an estimated $6.3 billion from its wallets, the exchange said in its withdrawal recovery update. The first phase is scheduled for 06:00 to 09:00 UTC. Deposits remain open, and the exchange says it will restore withdrawals asset by asset and network by network after security checks.

A withdrawal has two parts: the asset a customer sends, and the blockchain network that carries it. Binance is reopening selected combinations gradually. For example, the first phase includes bitcoin on the Bitcoin network, ether and USDC on Ethereum, and BNB and stablecoins on BNB Smart Chain. A customer must choose a supported network for the asset; Binance says availability will appear on the withdrawal page as each combination returns. The staged process works like reopening lanes one at a time after checking each route.

Which withdrawal routes are scheduled to reopen first?

Binance’s list also includes TRON, Solana, XRP Ledger, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism, Sui, Dogecoin, Zcash and TON. Not every asset is available on every network. Binance says it prioritised the first group using user demand over the previous week, and will add other networks and assets after readiness checks. It warned that high traffic could cause delays during the initial rollout.

The announcement describes a plan to resume withdrawals, not a return of every withdrawal service at once. The exchange says it will monitor services as they come back online. Its update does not say that trading was halted.

How did the theft happen?

Binance’s initial investigation suggested that an attacker may have used a compromised laptop belonging to a DevOps engineer to access a service container and submit unauthorised withdrawal transactions. Binance said it found no evidence that wallet private keys had leaked. It put the estimated impact at about $6.3 billion and said it had worked with blockchain partners to freeze roughly $3 billion on-chain.

The Associated Press reported that blockchain intelligence firm TRM attributed the attack to TraderTraitor, a North Korean hacking unit, with high confidence. TRM said about $6.36 billion was moved from Binance wallets across ten blockchains, most of it in roughly 20 minutes. Binance said it was still investigating and would publish a technical post-mortem when the facts were verified.

Who covers the stolen funds?

Binance says it will absorb the losses through company funds and its Secure Asset Fund for Users, or SAFU, rather than pass them to customers. The exchange also says user funds remain safe. The staged withdrawal restart restores a way for customers to move supported assets off the platform, while the investigation and recovery work continue.

Source material

• withdrawal recovery update — binance.com