Binance Hack Day Two: Withdrawals, Frozen Funds, and What to Check Before Moving Coins Back

Short answer: Binance withdrawals are still paused on the morning of October 31, 2026.

Binance says it will reopen them in phases, starting within about 34 hours of its October 30 update, which points to around November 1. Until a withdrawal of yours actually lands in your own wallet, treat every reopening date as a target, not a promise.

That single distinction shapes everything else in this article. Binance has set aside more than $6.34 billion to cover losses, and about $3 billion in stolen assets has been frozen on chain.

Those two facts are real, but neither one puts coins back in your wallet today.

Withdrawals are still paused, and that is the honest headline

Binance co-CEOs Yi He and Richard Teng said in their October 30 letter that withdrawals would restart in phases once security checks finish. Yi He had earlier put the window at about 42 hours, and the later update tightened it to about 34 hours from the update itself.

Both numbers describe the same plan at different moments, so do not treat the gap between them as a contradiction.

The reason for the wait matters more than the countdown. Binance says it is rebuilding parts of its withdrawal service and checking related addresses before it lets money move again.

A rushed reopening that still carried the original flaw would be worse than a slow one, and that is the one judgment call in this story where patience genuinely helps users.

Deposits and other unaffected services kept running while withdrawals stayed shut, according to Binance. That split confuses people, because an account can look normal while its exit door stays locked.

If you deposited during the pause, that deposit does not prove withdrawals work, and it does not change your place in any queue.

What “phased” reopening probably means for you

Phased means some tokens, networks, or accounts will likely reopen before others, though Binance has not published the order. Expect early reports of one coin moving while another still shows as suspended, and do not read that as favoritism.

Test with a small amount first when your turn comes, even if you normally move everything at once.

The numbers, reconciled in one table

Coverage of this hack throws around several billion-dollar figures, and they measure different things. The table below separates them, so you can see what each number actually claims.

Every figure comes from Binance or from the issuers and analytics firms named beside it.

The last row deserves a warning label of its own. It is our arithmetic, not a confirmed figure, because frozen totals can still rise as partners act.

Still, it frames the stakes honestly: roughly half the haul sits frozen, and roughly half does not.

Binance also promised a first proof-of-reserves snapshot within 12 hours of its October 30 update, with results due by Monday, November 2. That report will matter more than any statement, because it lets users check backing rather than take it on trust.

Read it skeptically anyway, and compare its date and scope before you celebrate it. Our day-one coverage of the Binance security scare explains how the story collided with a major options expiry, and why the first hours looked so chaotic.

Frozen does not mean recovered, and that gap is the whole story

Tether froze more than $1.567 billion in USDT, and Circle froze about $823 million in USDC, both in coordination with law enforcement. Ripple froze 40.5 million RLUSD and World Liberty Financial froze 27.8 million USD1, which takes the verified frozen total to about $3 billion.

Each freeze stops the attacker from moving those specific tokens, and that alone saved an enormous sum.

But a freeze is a lock, not a refund. Issuers still need a legal path to return frozen tokens to Binance, and experts quoted by CoinDesk stressed exactly that point.

Until that process completes, frozen stablecoins are stuck in place, which helps Binance but does not yet restore a single user balance.

Bitcoin and ether sit on the other side of this line, and the difference is structural. No issuer can blacklist a bitcoin address or an ether address, so the roughly 18,270 BTC in the haul and the ether portion can only be tracked, not switched off.

That is why the frozen total, impressive as it is, covers mostly stablecoins while the hardest assets to recover keep moving. If you want the full background on the exchange itself, our Binance review for beginners covers how its services fit together, and our look at Tether balances on exchanges shows why stablecoin flows matter so much in a crisis like this.

The Polymarket halt was separate, so keep the two stories apart

On the same day as the Binance breach, Polymarket halted trading on its international platform for about an hour. The company said a third-party provider was compromised, referred the matter to law enforcement, and promised that affected traders would be made whole.

Trading resumed at about 3 p.m. Eastern Time on October 29, and Polymarket said it is fully reimbursing all affected traders.

On-chain estimates put the Polymarket losses at about $2.7 million across roughly 700 accounts, though Polymarket itself has not published a loss figure. Sources cited by CNBC and Reuters identified the provider as DebugBear, a website performance monitoring firm, but Polymarket has not named it publicly.

The scale alone tells you these are different events: $2.7 million versus $6.3 billion, one hour versus days.

Merging the two incidents would mislead readers in both directions. It would inflate Polymarket into a Binance-scale event, and it would imply a shared cause that nobody has evidenced.

Treat them as a coincidence of timing on a bad day for crypto security, and judge each platform on its own response. For wider context on how often hacks hit this market, see our report that crypto hack losses topped $176 million in June even as incident counts fell.

What to check before you move coins back

When withdrawals reopen, your first job is not speed. It is verification, because scammers exploit exactly this moment with fake reopening announcements and copycat sites.

Work through these checks in order, and skip any step that asks you to trust a link you did not open yourself.

1. Confirm the reopening inside the official Binance app, not from a post. Open the app yourself and check the withdrawal page for your coin and network before you send anything.
2. Ignore every “withdrawals reopened” link on social media. Fake announcements with links to copycat sites were already circulating on October 30, and the real reopening needs no link.
3. Send a small test withdrawal first. Move a small amount to your own wallet, wait for confirmations, and only then move the rest.
4. Double-check the destination address and network, character by character. A correct coin on the wrong network can still be lost, and support cannot reverse a confirmed transfer.
5. Move long-term holdings to self-custody once withdrawals work. Our Sparrow Wallet walkthrough shows one free way to hold your own bitcoin, and our comparison of trusted crypto exchanges in Europe helps if you decide to spread holdings across venues.
6. Save screenshots of your balances and any error messages. If a withdrawal stalls, dated evidence speeds up any support case far more than a description from memory.

One more check costs nothing and prevents the most common post-hack loss. If anyone messages you claiming to be Binance support and asks for your password, seed phrase, or a code, it is a scam.

Real support never asks for those, and no reopening requires you to hand them over.

Bitcoin price: what the chart actually says

Bitcoin fell to about $76,400 on October 30, a six-week low, and traded near $77,000 on the morning of October 31. That bounce off the low is a fact, but it is not a signal, and this article makes no promise about where price goes next.

Anyone who tells you the hack alone sets the next direction is selling certainty that the market has not offered.

The level traders are watching sits right where price now trades. Bitcoin is trading right around the $76,500 short-term-holder cost basis area flagged in yesterday’s coverage.

Resistance above sits near $78,000, then $80,000 to $82,000, while a daily close below the moving average could open a move toward $74,000 and then $72,000. Our analysis of the $81,000 bounce shows how exchange outflows shaped the last recovery, which is the right lens for watching the next one.

What to watch next

Three dated milestones will tell you whether Binance is keeping its day-two promises. The phased withdrawal restart should begin around November 1 if the 34-hour target holds, and the real test is completed customer withdrawals, not an announcement.

The proof-of-reserves results are due by November 2, and further verified technical findings are expected within about 48 hours of the October 30 update.

Watch the frozen total too, because it can still climb as partners act. Each new freeze shrinks the attacker’s movable haul, even if recovery takes longer.

And watch for the post-mortem Binance promised, since it should explain how the breach happened and what changes now. Until those documents land, the honest summary stays short: losses covered on paper, withdrawals still paused, and your coins safest once they sit in a wallet you control.

FAQs

Readers keep asking the same six questions about this hack, so here are direct answers based on the latest verified updates.

Are Binance withdrawals open again?

No, withdrawals were still paused at publish time on October 31, 2026. Binance targets a phased restart starting within about 34 hours of its October 30 update, which points to around November 1.

Will Binance cover all user losses from the hack?

Binance says yes, and it has set aside more than $6.34 billion through its SAFU fund and company treasury. The proof will come when withdrawals complete and the proof-of-reserves results publish by November 2.

What does it mean that $3 billion was frozen?

It means issuers blacklisted stolen stablecoins so attackers cannot move or sell them. Frozen tokens are not automatically returned, so recovery still needs a legal process after the freeze.

Why can bitcoin not be frozen like USDT?

USDT and USDC have issuers who can blacklist addresses, while bitcoin has no issuer and no central switch. Stolen bitcoin can only be tracked across wallets, not switched off at the network level.

Was the Polymarket halt connected to the Binance hack?

No evidence links the two incidents. Polymarket halted its international platform for about an hour on October 29 after a third-party provider compromise, then resumed trading and promised full reimbursement to affected traders.

Should I move my coins off Binance when withdrawals reopen?

For coins you plan to hold long term, self-custody removes exchange risk entirely. Test with a small withdrawal first, verify it lands, and only then move the rest to a wallet you control.

Conclusion

Day two brings clarity without closure. Binance has named its numbers, set its dates, and kept withdrawals shut while it rebuilds, and that caution deserves credit even as it frustrates users.

The next verdict belongs to evidence: withdrawals that actually land, reserves that actually verify, and a post-mortem that actually explains.

Until then, do the unglamorous work. Ignore fake reopening links, test small, check addresses twice, and move long-term coins to your own wallet when the door opens.

Nobody knows the next price move, but everybody can control that much, and in a week like this one, that control is worth more than any prediction.