Binance Opens Second Withdrawal Phase as Deposits Overtake Outflows

Binance moved into the second stage of restoring withdrawals on November 3, reopening access to additional assets across nine blockchain networks in the latest step of its recovery from a record security breach. According to Binance’s Security Incident Recovery Update number six, as reported by BSCN and other outlets, the second phase began at 04:00 UTC on November 3. The move followed an initial restoration phase that began on November 1, and it expanded the list of assets and networks that users could withdraw from the world’s largest cryptocurrency exchange by trading volume. For customers who had been unable to move funds since the attack, the announcement was a practical milestone, even though the process remained gradual rather than instant.

The breach itself set the scale of the challenge. Binance suffered a theft reported at approximately $6.3 billion, an event that has been described as the largest crypto theft on record. The exchange suspended withdrawals after the attack, then began restoring them in stages once security checks allowed. The phased approach reflects a difficult trade-off. Restoring everything at once would be faster for users, but it would also increase operational risk at a moment when the exchange was still securing its systems. Restoring access step by step, asset by asset, is slower and more frustrating for some users, yet it allows the exchange to test each reopening before moving to the next. Phase two was therefore not just a larger list of tokens. It was evidence that the staged method was continuing to work.

Binance Withdrawals Phase 2: Nine Networks Reopened

The Binance withdrawals phase 2 reopening covered BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron, and Base, according to Binance’s update as reported by BSCN. That breadth matters because users hold assets on many different chains, and a reopening confined to one or two networks would have left many customers still waiting. By covering nine networks at once, even on a progressive basis, Binance widened the path for users who wanted to move funds to self-custody, to another platform, or simply to confirm that their balances were accessible.

The list of assets in phase two was also broad. BSCN reported that it included Bitcoin, Ethereum, XRP, Solana, Dogecoin, Chainlink, Cardano, Litecoin, and Shiba Inu, alongside selected assets on Sui, Arbitrum, Optimism, Tron, and Base. BraveNewCoin also listed USD1 and FDUSD, as well as Pendle, WIF, and Bonk, among the assets covered, and noted that all bSTOCKS tokenised stocks on BNB Smart Chain were included. That combination of large, widely held coins and smaller, more specialised tokens shows that the reopening was not limited to the safest or simplest cases. It reached into the long tail of assets that many active traders actually hold, which is why the phase was described by several outlets as the biggest reopening since the attack.

A Progressive Rollout, Not a Single Switch

Binance was clear that phase two would not happen all at once. BSCN quoted the exchange as saying that, like phase one, reopening would roll out progressively across assets as security and readiness checks were completed. In practice, that means a token on one of the nine networks could become withdrawable while another token on the same network remained unavailable for a time. Users were advised to check the withdrawal page or the network status page for their specific asset and chain before attempting a transfer, rather than assuming that inclusion in the phase two list meant immediate availability.

That caution is important for managing expectations. A progressive rollout can look uneven from the outside, and users who see one asset reopen while theirs remains closed may reasonably wonder whether something has gone wrong. In a staged recovery, unevenness is the design, not a failure of it. Each asset must pass its own checks, and demand over the preceding week helped determine the order in which tokens were prioritised, according to Binance’s update. The exchange also warned that temporary delays could occur during the rollout because of high traffic, and that users whose withdrawals were unsuccessful should try again later. Those warnings are standard in a high-volume reopening, but they carry extra weight after a security incident, when users are understandably anxious about access to their funds.

Deposits Begin to Overtake Withdrawals

One of the most encouraging signs in the recovery story was a shift in the balance between money leaving and money entering the exchange. According to BraveNewCoin’s summary of the recovery data, by 03:00 UTC on November 3, hourly deposits on Binance had exceeded withdrawals, a reversal from the heavy net outflows seen immediately after withdrawals resumed. That single hourly snapshot does not prove that the outflow episode is over, but it does suggest that the initial rush to exit had begun to ease and that some users were once again willing to deposit funds.

The longer window tells a more sober story, and both parts of the picture deserve attention. Over a 46-hour window from November 1 to November 3, Binance saw approximately $10.97 billion in withdrawals against approximately $5.695 billion in deposits, a net outflow of approximately $5.276 billion, according to BraveNewCoin’s summary. Reuters, meanwhile, reported approximately $4.72 billion in net withdrawals by Monday, equivalent to about 3 percent of platform assets. The difference between those figures reflects different measurement windows and methods, not a contradiction. What they share is a clear pattern: a very large initial outflow, followed by signs that the pace was slowing. DefiLlama data cited by Cointelegraph and other outlets pointed in the same direction, with net outflows falling to $2.57 billion on Monday from $6.1 billion on Sunday, the first full day after withdrawals resumed. A slowing outflow, combined with an hour in which deposits exceeded withdrawals, is the kind of early stabilisation signal that traders watch for after an exchange crisis.

Binance Recovery Update and the Question of Losses

A central question throughout the recovery has been who bears the financial cost of the stolen funds. Binance has repeatedly said that it will absorb the financial impact itself and that losses will not be passed on to users. BSCN reported that position again in its coverage of phase two, and other outlets have carried the same assurance. That commitment matters because it addresses the fear that customers might face haircuts, frozen balances, or socialised losses. It does not, on its own, restore confidence, but it removes one of the worst outcomes that users might have feared in the days after the attack.

The related question is how much of the affected value Binance has covered. BSCN reported that Binance later said it had covered approximately 95 percent of the affected assets, up from an earlier figure of about 90 percent. CNBC, as cited by BSCN, noted an important distinction: restoring backing for about 90 percent of assets does not mean Binance recovered 90 percent of the funds from the attacker. Covering assets can involve the exchange’s own reserves, insurance-style funds, and corporate resources, rather than recovery of stolen coins. The distinction is technical, but it matters for understanding what has actually happened. Users care most about whether their balances are backed and withdrawable. The source of that backing matters less to them in the short term, though it matters a great deal to the exchange’s longer-term financial position and to regulators who will examine the incident.

What Phase Two Means for the Wider Market

The wider significance of phase two goes beyond Binance’s own users. Binance is the largest exchange by trading volume, and its ability to restore withdrawals in an orderly way affects confidence across the crypto market. When withdrawals were suspended, traders worried about contagion, about whether other platforms might face similar attacks, and about whether liquidity would dry up. A staged but expanding reopening, combined with slowing outflows and a reserve snapshot due on November 4, helps to contain those fears. BraveNewCoin also noted that the next reserve snapshot was due on November 4, covering additional cryptocurrencies beyond the October 31 snapshot, for which a zero-knowledge proof had been completed on November 2 for ten major cryptocurrencies.

At the same time, phase two does not close the story. The exchange has not provided a fixed completion date for the full restoration process, and some assets will remain unavailable until their checks are complete. Investigations into the attack, questions about how the breach occurred, and scrutiny from regulators and law enforcement are likely to continue long after withdrawals are fully restored. For traders, the practical lessons are already clear: keep withdrawal status pages bookmarked, verify availability before attempting large transfers, be sceptical of any offer to accelerate access, and consider the risks of holding large balances on any single platform. Phase two was a meaningful step toward normal operations, but normal operations will only be confirmed when the remaining assets are restored and the reserve evidence has been examined.

FAQ

When did Binance withdrawals phase 2 begin?

At 04:00 UTC on November 3, according to Binance’s Recovery Update number six, as reported by BSCN. That is 09:00 PKT. Assets reopened progressively after that start, depending on security checks.

Which networks were included?

BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron, and Base, plus all bSTOCKS tokenised stocks on BNB Smart Chain. Users still needed to check the status page for each asset.

Did deposits really overtake withdrawals?

Hourly deposits exceeded withdrawals by 03:00 UTC on November 3, according to BraveNewCoin’s summary of the recovery data. Over the longer 46-hour window, however, withdrawals of about $10.97 billion still exceeded deposits of about $5.695 billion.

Will Binance users bear the losses from the hack?

No, according to Binance. The exchange said it will absorb the financial impact and that losses will not be passed on to users. It also reported covering about 95 percent of affected assets.

What should users watch for next?

The reserve snapshot due November 4, and the continued reopening of remaining assets. Users should also ignore anyone offering to expedite a withdrawal for a fee, which Binance warned is a scam.

Source: Binance / BraveNewCoin

Related reading on MM Crypto Analysis Web

• Bitcoin Braces for US Midterm Elections as History Warns of Sell-Offs
• Binance Hack Funds Spread Across 12,000 Wallets
• Binance Sheds $16 Billion in Assets Since Hack

More in Bitcoin on MM Crypto Analysis Web.