Binance Withdrawals After the Hack: Solana and XRP Paused, Bitcoin and Ethereum Open

Update 3 November, 01:03 UTC: Binance's proof of reserves can now be checked by users. In its “Recovery Update #5” of 2 November (12:45 UTC) Binance says the zero-knowledge proof for the 31 October snapshot is complete. Anyone holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC on Binance can use the verification tool on the proof of reserves page to check that their balance is backed at least 1:1. The exchange says it has replaced about 95 percent of the stolen amount; the remaining 5 percent are less liquid tokens outside these ten. A new snapshot covering more tokens follows on 4 November, and its proof is expected to take 40 to 50 hours. The next phase of withdrawals for further networks is planned for 3 November. More: How to check Binance's proof of reserves.

Update 1 November, 07:48 UTC: Binance has reopened the first withdrawals. According to Binance's network status, Bitcoin withdrawals on the Bitcoin network have been available again since 07:00 UTC at the latest, and Ether on the Ethereum network, USDT and USDC on Ethereum and BNB Smart Chain, and BNB followed at around 07:48 UTC. Further phase-one networks are following step by step. Which 15 networks open first and what customers should watch out for is in Binance reopens withdrawals.

Update 10:45 UTC: trail leads to North Korea, withdrawals within 48 hours. Investigators at TRM Labs attribute the Binance hack with high confidence to North Korea's TraderTraitor group, and Chainalysis points to the same group; Binance has not named an attacker. According to TRM Labs, about $6.36 billion left across ten blockchains, about $2.7 billion is frozen, and the attacker holds more than 420,000 ETH and 18,270 BTC across all wallets. Binance expects to reopen withdrawals within 48 hours; deposits work. Everything in one place: North Korea behind the Binance hack? What we know.

Update 02:30 UTC: Binance puts the damage at $6.3 billion. In an official announcement Binance estimates the total impact at around $6.3 billion, of which about $3 billion is frozen on-chain. According to the initial investigation, a DevOps engineer's laptop was compromised, which let the attacker access a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence of a private key leak. The exchange will cover all losses from the SAFU fund and company funds; deposits and withdrawals remain suspended, and an updated proof of reserves will follow.

Update 01:25 UTC: Binance confirms the hack. Co-founder Yi He wrote at 00:04 UTC that user funds are safe and Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while the exchange runs security checks, freezes funds and works with law enforcement. According to on-chain investigator ZachXBT, more than $2.83 billion is now frozen. Before the freezes, the attacker had supplied 60 million USDT to Aave and borrowed 19,762 wETH, about $45 million, against it, as Marc Zeller of the Aave Chan Initiative explains.

User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.

Yi He (@heyibinance) October 30, 2026

Can you withdraw from Binance right now? No, not for the time being. Binance co-founder Yi He confirmed at 00:04 UTC on Friday that deposits and withdrawals are temporarily suspended while the exchange runs security checks, freezes funds and works with law enforcement. She also says user funds are safe and Binance will cover all hacking losses. Before that, Binance had already paused withdrawals for Solana, XRP and stablecoins on several networks. The exchange's public status interface still showed Bitcoin and Ether withdrawals as active at 01:16 UTC; Binance's statement is what counts.

Earlier in the evening a Binance hot wallet was drained of about $2.8 billion. Details are in our Binance hack report, the market impact in our crypto crash timeline.

Advertisement, for readers in the EU: If you no longer want to keep your coins on Binance after the hack, Bitpanda compares itself with Binance, Kraken, Coinbase and Crypto.com and shows a three-step guide to moving your crypto. Bitpanda is licensed in the EU under MiCA. Other MiCA-licensed alternatives in the EU are Coinbase (licensed via Luxembourg) and OKX (licensed via Malta).

Which EU-licensed exchanges are a Binance alternative, what they charge and how to move your crypto is covered in our guide Binance alternatives: 4 MiCA-licensed exchanges compared.

Binance withdrawals: status by network

Measured at 22:32 UTC on the interface Binance uses for its own deposit and withdrawal page. The table shows the most used networks; permanently unsupported routes are left out.

Why are Solana and XRP withdrawals paused?

Binance shows the same sentence for every paused network: the wallet is undergoing maintenance and withdrawals will resume shortly. For USDT on Polygon it says the hot wallet is being replenished. The exchange has not said whether the pauses are linked to the suspected hack. The pattern is striking all the same: mostly networks whose hot wallets can run dry after a wave of withdrawals are paused, while the big routes via Ethereum, Bitcoin and Tron stay open.

Solana and XRP holders have a way out: both coins can still be withdrawn via BNB Smart Chain, XRP also via Ethereum, provided your destination wallet supports that network. What happened to Solana tonight is in our article Solana Crash: SOL falls below $100.

What Binance itself says

So far the exchange only confirms an investigation and explicitly warns of scams: users should not trust unofficial links, messages or requests for account information.

Our teams are aware of reports of a potential security issue and are actively investigating. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.

Binance (@binance) October 29, 2026

More on the Binance hack

• Binance hack: how the hot wallet was drained
• On-chain analysis: what the blockchain shows about the hack
• Live ticker and timeline: the crypto crash after the hack
• USDT frozen: what Tether and Circle really blocked
• Is this the end? Three scenarios for Bitcoin
• Ethereum: the hacker sits on 195,000 ETH
• Solana below $100: is $80 next?
• BNB crash: another FTT moment?
• The biggest crypto hacks in history
• How to short Bitcoin in the crash
• Why is crypto down today?

How to withdraw your coins safely from Binance

• Pick a network with open withdrawals. For example USDT via Ethereum or Tron instead of Solana. Check first that your wallet supports the network, otherwise the coins are lost.
• Send a small test amount first. Once it arrives, send the rest. It costs one more fee but protects against typos in the address.
• No links from messages. Fake emails and messages promising refunds or a "security check" pile up after hacks. Open Binance only via its own app or a typed address.
• Use your own wallet. What sits on an exchange is controlled by the exchange. Suitable devices are listed in our hardware wallet comparison, licensed exchanges in our comparison of regulated exchanges.

We keep measuring the network status and will update this article as Binance reopens or pauses withdrawals. This article is not investment advice.