This afternoon, Binance’s first withdrawal gate really opened.

According to official recovery announcement #4, the first phase will restore withdrawals in batches between 14:00 and 17:00 Beijing time (06:00–09:00 UTC)—it’s not a one-click reopening of the entire platform. The first batch covers 15 networks: BTC, ETH, BSC, TRX, SOL, XRP, ZEC, DOGE, TON, Polygon, Avalanche, Arbitrum, Base, Optimism, and Sui. The order isn’t based on market cap; it’s based on users’ withdrawal demand over the past week—the networks with the most urgent withdrawal requests will open first. The official announcement also offered an advance warning: delays and failed attempts that need to be retried are to be expected at first, so don’t mistake congestion for a second incident.

Break down the numbers separately: 95% and 100% refer to two different things.

Officials say about 95% of the total amount stolen has been covered, up five percentage points from the roughly 90% reported in the previous update. They also say that the balances of the top ten assets—BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC—are 100% fully backed. These statements aren't contradictory: the major coins were topped up first, while the remaining roughly 5% consists of smaller coins outside the top ten that have low liquidity and take longer to buy. Using the roughly $6.3 billion stolen as a ballpark figure, 5% comes to more than $300 million. That's not yet covered, and it's no small remainder.

It's also important to distinguish replenishing reserves from recovering stolen funds. Withdrawals can resume because the company used its own funds to buy coins and replenish reserves—not because the stolen coins were recovered and returned. About $3 billion has reportedly been identified and frozen (estimates from different sources range from roughly $2.7 billion to $3 billion). Frozen doesn't mean recovered, much less automatically returned to users. The fast replenishment deserves credit; the slow recovery of stolen funds should also be kept on the books.

There has also been progress in attribution beyond what officials have said. On October 31, the U.S. Federal Bureau of Investigation linked North Korean hacking group TraderTraitor to the case. TRM Labs estimates that about 18,270 bitcoins, worth roughly $1.47 billion, were stolen. This is still a conclusion about “who did it,” not a tally of “how much money has come back”—don't confuse the two.

So there's no need to rush to declare “the crisis is over” tonight. Keep three questions in mind:

First, when will Phase 2 begin, and which networks will it cover? Officials still haven't given a date; they've only said they'll add more once they're ready.

Second, when will the remaining roughly 5% be replenished, and which coins does it cover?

Third, when will the full proof of reserves and the post-incident technical report be delivered? Sources disagree on the timing of the full version: some say November 2, others November 3. We'll go by Binance's subsequent official announcement and won't vouch for a date in advance.

Don't read too much into prices either. Bitcoin is around $77,800 today, and the Fear & Greed Index is at 34. The market hasn't surged just because withdrawals resumed. The ability to withdraw restores confidence in access, not a price signal. Confidence in access will depend on three things being delivered one by one: Phase 2, the remaining reserve replenishment, and the full proof.

One real question to end on: If you hold coins that aren't on the 15 networks in Phase 1, would you wait for Phase 2 or move them to a network that's already open? Why? Let's talk in the comments.

No hype—just the numbers.

$BTC $BNB

#币安 #SecurityIncident