Binance Reopens Bitcoin Withdrawals in First Phase After $6.3 Billion Hack

Binance has reopened Bitcoin network withdrawals, the first phase of a staged resumption of services after a hack that drained approximately $6.3 billion in user funds — the largest theft in the exchange's history. The FBI has attributed the attack, which occurred on Thursday, to North Korean operatives.

The exchange confirmed the move on X. "First batch network now opened in phase one of withdrawals is $BTC bitcoin network," Binance said. Bitcoin is the only network available at this stage; other assets remain locked pending further rollout.

How will the phased withdrawal system work?

Binance first announced the phased approach on Sunday, stating that withdrawal services would roll out progressively and that updates would appear on its official X channel. The sequencing is not arbitrary. The exchange is prioritizing tokens based on demand data from the past week.

"We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened," Binance said. That statement leaves one question open: the exchange did not specify how many phases are planned or which networks follow Bitcoin.

Users must verify availability themselves. Binance directed customers to check the withdrawal page for their selected asset and network, or to consult the Binance network status page before attempting a transfer. The exchange also warned of friction during the rollout: congestion, longer processing times and temporary delays are expected. If a withdrawal fails, users should retry after a short interval.

How much of the stolen money has been recovered?

Cointelegraph reported on Saturday that Binance had replenished 90% of the assets stolen in the hack, up from 80% a day earlier. That is a ten-percentage-point recovery in roughly 24 hours, and the exchange said it remained on track to resume withdrawals on Sunday — a deadline it has now met, at least for Bitcoin.

The remaining gap matters. A 90% replenishment rate means roughly one in ten stolen dollars has not yet been restored, and Binance has not said when full coverage will arrive. The company has also not detailed how the replenishment is being funded.

What comes next?

The Bitcoin network reopening is a test case for the phases that follow. Each subsequent network and asset pair must pass stability and security checks before access resumes, which suggests the full timeline depends on engineering outcomes rather than a fixed schedule. Users holding assets on networks beyond Bitcoin should expect continued lockups, intermittent delays and possible failed withdrawal attempts in the near term.