Binance’s phased reopening of withdrawals is now the central test of whether the world’s largest crypto exchange can restore normal service after a $6.3bn theft on Thursday, described as the biggest heist in history and attributed by experts to North Korea as the probable culprit.
The picture is one of a system brought back in stages. Binance froze withdrawals while it investigated the breach, then announced on Sunday that it had begun a phased reopening. By Sunday afternoon the platform had processed $4.6bn in withdrawals and $1bn in deposits, a net outflow of about $3.6bn, equal to 2.1% of its $171bn in total assets under management. The company confirmed those figures in its latest proof of reserves snapshot, and a full report is expected today.
Service restoration has continued into Monday. The exchange confirmed that customers can now withdraw cash in US dollars, adding to euro, yen and some other fiat currency withdrawals that were already restored. On X, the company said it will continue to share further updates today.
Running the platform through recovery has also meant running a security operation against its own users. Changpeng Zhao, the founder known as CZ, warned that scammers are in “overdrive” and are targeting customers trying to pull their money out. He wrote on X that posts and screenshots circulating recently are fake and the information in them is false, directing users to official channels and announcements for accurate information. Binance has confirmed that screenshots promising $150 in free compensation for withdrawal suspensions are digitally altered and constitute false information.
Yi He, the exchange’s co-founder, framed the operational priority directly: ensuring the environment is secure, after which users can withdraw their funds and Binance can resume operations. She rejected comparisons with collapsed rival FTX, writing that fraudulent exchanges, P2P platforms and commercial banks have opaque ledgers, and that when such operations shut down they simply abscond with the funds, leaving no one to explain what happened and no possibility of reopening withdrawals. Her argument is that Binance’s situation is the opposite: an operating platform working through a security incident with withdrawals being restored.
Meanwhile, the breach’s effects are visible in how the wider trading infrastructure is performing. Nick Forster, chief executive of the crypto platform Derive.xyz, said US spot Bitcoin ETFs recorded $643 million in net outflows on Friday, their first trading session after the hack. BlackRock’s IBIT saw $233.7 million in outflows, Fidelity’s FBTC lost $201 million, ARKB $129.5 million, GBTC $53.3 million and BITB $25.7 million, with no fund recording net inflows. On Derive’s own options market, put options accounted for 68% of Bitcoin options premiums traded in the first 12 hours after the hack, compared with 43% in the preceding five days, with daily Bitcoin options volume running at approximately $55 million since the hack against $34 million the day prior. Forster noted that the odds of Bitcoin reaching $100,000 by the end of the year have fallen from 6% last Wednesday to 3.5%, roughly a one-in-30 chance, and that options had priced a 75% probability of Bitcoin finishing above $80,000 at Friday’s expiry before it settled at $77,786.
Regulators are moving to inspect the systems themselves. South Korea’s financial regulator held an emergency meeting on Monday to examine local exchanges’ cybersecurity, ordering measures that can be implemented immediately, including constant transaction monitoring, response systems to detect and report irregular access attempts, raising the ratio of cold wallets that secure private keys offline, and increasing reserve deposits. In Hong Kong, the Securities and Futures Commission is expected to step up guidance to the crypto industry through new circulars in the last two months of the year, according to Eric Yip, the commission’s executive director for intermediaries, speaking at Hong Kong’s FinTech week forum.
By contrast with Binance, rival platform Chainalysis said on Friday it had also been targeted by a cyber attack, though it found no evidence of unauthorised access to investigation content, authentication credentials or session tokens, and said the incident is not related to the Binance theft. Its team is working with cybersecurity experts to harden systems and has proactively notified customers. Further coverage of the market reaction is collected at https://www.theguardian.com/business/live/2026/nov/02/crypto-scam-binance-billion-hack-business-live-latest-updates-news.
Whether Binance’s full report today confirms the phased reopening has held, and whether the promised fiat services stay live, will show whether the recovery plan is working as designed.