Mentioned in This Article
1. What did Binance announce for the second phase?
Binance said that more assets will become available for withdrawal in stages beginning at 04:00 UTC on Tuesday, November 3, 2026. The announcement came through the exchange's recovery notice on X and describes the second step of a reopening that started on Sunday, November 1, after the theft of roughly $6.3 billion in crypto from the platform in the previous week.
The exchange said the second phase follows the same logic as the first. Tokens are not switched on all at once. Each one returns to service as the security and readiness checks for that asset and its network are completed, which means some withdrawal options may appear later than others during the day.
Deposits, the company confirmed, remain open. Customers can therefore still send funds to the exchange while the outbound side is being restored in steps. Binance did not give a date by which every asset would be available again, and the statement framed the process as progressive rather than tied to a single deadline.
2. How does the Binance withdrawal reopening work?
Binance is ordering the reopening by demand. The exchange said it is ranking tokens according to how much users have wanted them over the past week, so the assets that customers have tried hardest to move are among the first to be restored. The approach concentrates the exchange's checking effort where the largest number of customers are waiting.
A phased restart is a common response after a serious security incident at a custodian. A platform that holds customer funds must be confident that each withdrawal route is working correctly and that the wallets feeding it are secure before letting money flow. Turning on an entire catalogue of tokens at once would multiply the number of systems that need to be verified in the same hours, and any error in one of them could add to the damage already done.
Withdrawals also differ from deposits in the risk they carry. An incoming transfer adds to the exchange's holdings, while an outgoing one drains them, so a flaw in the outgoing path can be exploited directly. That asymmetry explains why deposits can stay open throughout an incident while withdrawals are held back until controls are verified.
3. Which networks return in phase two?
The second phase covers a set of large blockchains that many customers use to move funds. Binance listed Binance Smart Chain, Ethereum, Solana, the XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base among the networks in this stage. Together they span the main general-purpose chains, several layer-2 networks built on Ethereum, and the networks that carry a large share of stablecoin transfers.
For users, the list matters because a withdrawal is tied to a specific network as well as to a token. A coin may exist on several chains, and each chain has its own wallet infrastructure on the exchange side. Reopening a network therefore restores every supported asset that travels over it, once the corresponding checks are finished, rather than a single coin.
The inclusion of Ethereum and its layer-2 networks, as well as Solana and Tron, reflects how much everyday activity runs on a handful of chains. Restoring them in the second phase suggests the exchange is working through its busiest routes first, consistent with its stated demand-based ranking.
4. What happened in the Binance hack?
The reopening follows an attack disclosed in late October 2026 that Binance described as the largest crypto theft on record, with about $6.3 billion in unauthorized withdrawals. The scale places it far above earlier exchange breaches, and it prompted the exchange to pause withdrawals while it worked on security improvements and prepared a phased restart.
Earlier in the week, Binance indicated that deposits were unaffected by the incident and that it aimed to resume withdrawals within a short window. The first reopening on November 1 was the outcome of that plan, and the Tuesday step continues it. For many customers, the central question since the attack has been how quickly they could access their balances again, and the staged schedule is the exchange's answer to it.
Large thefts of this kind also raise questions that go beyond the platform itself, including how stolen funds move across chains, how regulators respond and whether customers keep their assets on exchanges. Those questions remain open, and the pace of the recovery is one of the signals observers are watching.
5. Why does the pace of withdrawals matter for confidence?
After a breach, the speed and orderliness of withdrawals is one of the clearest tests of an exchange's solvency and operational control. If customers can move funds out without delay, fears of a shortfall tend to ease. If the process stalls or errors appear, those fears can spread, prompting more customers to try to withdraw at the same time.
This is the dynamic often described as a run. In an ordinary bank, a run can force a lender to sell assets quickly or limit access to deposits. A crypto exchange faces a version of the same pressure, because customers can see on-chain flows in real time and react to them within minutes. A visible slowdown in outflows after the first rush is therefore read as a sign that the initial wave of anxiety is subsiding, which is how the coverage of the second phase characterized the trend.
Binance's decision to publish a clear timetable, down to the hour, is itself part of managing that pressure. Giving users a predictable schedule reduces the incentive to rush for the exit at the first moment a route opens, and it lets the exchange plan its liquidity and monitoring around known windows instead of unpredictable surges.
6. How should customers approach the reopening?
Users who are waiting for a particular asset can check the exchange's recovery notice for the current status of each token and network before attempting a transfer. Because assets return progressively, an option that is unavailable at one hour may be available later, and repeated attempts are not a way to jump the queue. Binance has said deposits remain open, so there is no need to move funds in a hurry to keep them accessible.
Security practice matters during any recovery period. Phased reopenings after incidents tend to be accompanied by a rise in impersonation attempts, so customers should rely only on the exchange's official channels for information and should not share credentials or approve unfamiliar requests. Withdrawal addresses and networks should be double-checked before sending, since a transfer on the wrong network can be difficult or impossible to recover.
Customers with large balances may also weigh how they want to custody their assets over the longer term. Self-custody and exchange custody involve different trade-offs between convenience and control, and an incident of this size tends to prompt many holders to reconsider the balance, though the decision remains an individual one.
7. What comes next after phase two?
The next milestone is the completion of the reopening. Binance has not named a date for the point at which all assets and networks will be available, saying only that the process continues as checks are finished. Further announcements through its recovery notice are the most likely way customers will learn which tokens return next.
Beyond the mechanics, attention is likely to turn to the aftermath: the tracing of the stolen funds, any actions by regulators and law enforcement, and the changes the exchange makes to its security practices. Each of these will shape how the industry judges the episode. For now, the Tuesday reopening at 04:00 UTC is the concrete step on the calendar, and its smoothness will be an early indicator of how quickly normal service returns.
8. Why do exchange wallet designs matter in a recovery?
Exchanges typically split customer assets between hot wallets, which are connected to the internet and used to process withdrawals quickly, and cold storage, which is kept offline and moved only through slower, more controlled procedures. The split is a trade-off: hot wallets make service fast but are exposed to attack, while cold storage is safer but takes longer to access.
When an incident touches the hot-wallet layer, a recovery usually involves rebuilding or re-securing that layer before large volumes can pass through it again. This is one reason an exchange may restore withdrawals in steps. Each stage lets operators watch live behaviour under real customer demand and adjust before the next group of assets is switched on.
The same design logic explains why a withdrawal route must be verified per network. Every blockchain has its own address formats, fee mechanics and confirmation rules, and the exchange's systems must handle each correctly. Verifying them one cluster at a time reduces the chance that a configuration mistake on one chain affects the others.
9. What does the second phase mean for traders?
For traders, a wider set of withdrawal options means that positions and balances can again be moved to other venues or to private wallets with fewer restrictions. Market participants often watch such reopenings closely because trapped balances can weigh on sentiment, and restored access can change how willing people are to keep funds on the platform.
Withdrawal availability can also affect how traders use the exchange itself. When outgoing transfers are limited, some prefer to hold positions on the platform instead of risking being unable to move collateral. As routes return, that constraint loosens, although the timing of each asset depends on Binance's own checks and not on market conditions.
Because the exchange has kept deposits open, customers can continue to fund accounts and trade while the remaining routes are restored. The Tuesday step does not end the recovery, but it widens the set of networks that are working in both directions.