Bitcoin withdrawals are moving again on Binance. On Sunday, 1 November, the exchange turned that service back on and opened the bitcoin network before the others. It scheduled the opening phase for 06:00 to 09:00 UTC, 1:00 a.m. to 4:00 a.m. in Panama, and a network returns only after its own security and readiness checks. Deposits kept working while sends off the exchange were paused.

The plan went out as Recovery Update #4 on the support site, and as a post on X at 04:11 UTC, before the window. At 06:20 UTC Binance wrote, “First batch network now opened.”

According to the announcement, the phase covers 15 networks, ordered by withdrawal demand over the past week, so the routes people had been using come back ahead of the quiet ones. A follow-up at 07:49 UTC said ether was back, with USDT and USDC, the two large dollar stablecoins, and that BNB, USDT and USDC were back on BNB Smart Chain. Further batches landed through the morning. At 12:36 UTC Binance said the phase-one group was enabled. At 16:12 UTC the exchange added that, by 12:36 UTC, withdrawals were open again on every network and asset in that group of 15. The 12:36 note is the list from that hour.

Those posts show the order of the morning. Bitcoin’s note hit at 06:20 UTC, inside the announced hours. Ethereum and BNB Smart Chain followed at 07:49 UTC, still inside them. A sender waiting on a network that appeared only on the 12:36 UTC list was in a later batch, and Binance still counted that batch as phase one. The opening hours had already ended.

In the 16:12 UTC post, Binance totaled the flows from 06:00 to 15:30 UTC. Outgoing transfers came to $4.649 billion. Incoming transfers came to $1.01 billion. The difference is a net outflow of about $3.64 billion, equal to 2.1% of the $171 billion in assets under management in its proof-of-reserves data from 28 October. Withdrawals surged at the reopen, then eased, and Binance said they are settling. Deposits stayed high across the same stretch. The exchange said market conditions are stable.

Coins outside this wave stay on their networks until Binance opens them. That post said testing on the rest is still going, and that the next phase has no published hour.

Binance warned that the morning would be busy. A crowded network can slow a withdrawal or cause it to fail. Binance told users to try again, and to look at the withdrawal screen for the asset and network they chose, or at the network status page, before treating a route as live.

The coverage figure moved with the restart. In Update #4, Binance said it has now covered about 95% of the impacted amount. A day earlier it had put that covered share near 90%. At 03:04 UTC, still before the window, the exchange said on X that the covered amount had reached $6 billion. Reuters described a theft of about $6.3 billion and said Binance bought replacement tokens with company money. CoinDesk reported the same phased restart, with bitcoin leading it.

The 95% measures replacement coins. In the announcement they are assets Binance has gathered so the balances customers see have matching coins behind them again. TokenPost said the percentage counts assets the exchange has replaced. Crypto seized from the attacker is a separate tally.

About 5% is still open. Binance said those tokens sit outside ten assets it now calls fully backed, and that they trade in thinner markets, so buying them in the size required takes longer. The ten named in the announcement are bitcoin, ether, USDT and BNB. The list goes on with solana, USDC, XRP, USD1, RLUSD and ZEC. Binance pointed to a snapshot on its proof-of-reserves site, where it posts the wallets it says stand behind customer balances.

Binance said the company will carry the cost of the stolen funds. The loss is not passed through to users.

The reserves list changed with the reopening. Binance published newly generated wallet addresses and said withdrawals are now sent from those addresses. A reserves snapshot was recorded at 00:00 UTC on 31 October, and computing the zero-knowledge proof for that snapshot has started. Binance expects the updated report on its proof-of-reserves site on 2 November. A customer can then test whether their own balance sits inside the reserve total.

Yi He, a Binance co-chief executive, wrote on X at 12:05 UTC that a community rewards campaign has to clear a regulator before it can start, and that the review would come only after offices open on Monday. She said no cash-voucher campaign is running, and she told users to watch for phishing and scam links.

Saturday’s FBI alert, reported here, attributed a theft above $6 billion to North Korea and called the activity TraderTraitor.

CBS News, with AFP, reported the Sunday restart for bitcoin and ether. By 5:35 a.m. Eastern its story had bitcoin, ether, BNB, XRP, Base, dogecoin and Optimism restored, and said further phases were still ahead. Reuters said bitcoin returned shortly after 06:00 UTC, with ether, BNB and some of the dollar stablecoins behind it.

Binance said a full report on the incident will follow once the investigation is done.