• Binance began reopening withdrawals in phases on 1 November 2026, starting with bitcoin, ether, USDT, USDC, BNB and XRP. Later phases have no announced dates.
• Binance says it has covered about 95% of the impacted amount, up from 90%, and will not pass the loss to users. These are company statements, not independently audited figures.
• TRM Labs puts the total theft at $6.36 billion, against Binance's estimate of about $6.3 billion. The 18,270 BTC component, about $1.47 billion, is only one part of that total.
• About $3 billion is reported immobilized, largely in stablecoins. Bitcoin and ether cannot be frozen the same way.
• For counterparties and users, the open verification points are the full proof-of-reserves report and the reopening timetable for each chain.

Binance has begun reopening withdrawals in phases after a theft it estimates at about $6.3 billion, but the restart settles little on its own. The exchange says it is absorbing the loss and has covered most of it, yet those figures are Binance's own, relayed by CoinDesk. What can be checked from outside is the on-chain tracing by analytics firms and, once it is released, the promised proof-of-reserves report.

What was taken and how it is measured

Binance estimated the theft at about $6.3 billion, while TRM Labs titled its own analysis $6.36 billion. Neither source reconciles the two numbers, and the difference may reflect different pricing times. CoinDesk relayed TRM's component figures: 18,270 BTC, valued at about $1.47 billion, plus 200,630 ETH, 1.875 billion USDT and 823 million USDC, with further XRP and SOL. The bitcoin figure is one component of the total, not the whole loss.

How the phased restart works

Binance began phase one of its restart on Sunday, 1 November 2026, between 06:00 and 09:00 UTC, covering bitcoin, ether, USDT, USDC, BNB and XRP, according to CoinDesk. Later phases follow only once each blockchain clears further security and stability checks, and no dates were given. The practical effect is uneven access: customers holding assets on networks that have not yet reopened cannot withdraw them, and the timetable for those networks is open-ended.

What is verified and what is a company claim

Most of the reassuring figures are Binance's own. The company says it has covered about 95% of the impacted amount, up from 90%, using its own funds including the Secure Asset Fund for Users, and says it is buying back the remainder through market and over-the-counter channels. It also says listed balances are fully backed, with a full proof-of-reserves report promised but undated. CoinDesk's report describes no independent audit of these claims, so they stand as company statements.

Credit and frozen funds

TRM Labs attributes the theft to TraderTraitor, a North Korean-linked actor; that is the analytics firm's assessment, not a law-enforcement finding cited in either source. CoinDesk reports that about $3 billion is immobilized, largely in stablecoins. That split matters because stablecoin issuers can block addresses, whereas bitcoin and ether cannot be frozen the same way and recovery there depends on tracing and exchange cooperation. For counterparties, the checkpoints are the full proof-of-reserves report and the timing of each remaining phase.