Binance Reopens in Phases: What Sunday’s Window Proves — and What Monday and Tuesday Still Must

Binance is reopening withdrawals on Sunday, but the honest headline is narrower than the celebratory one: this is a partial reopening, inside a window, for a subset of networks and assets. Phase one runs from 06:00 to 09:00 UTC — 13:00 to 16:00 Vietnam time — across 15 networks, covering Bitcoin, Ether, BNB, Tron, Solana, XRP, Zcash, Dogecoin, Toncoin, Polygon, Avalanche, Arbitrum, Base, Optimism and Sui. Binance itself warns that some users may face delays or failures at first. That warning is not boilerplate. It is the difference between a switch being flipped and a system being tested under load.

At the time of writing, early in that window, no independent confirmation of completed user withdrawals had surfaced in the coverage checked — only Binance’s own scheduled plan, reported by Reuters and other outlets. So the correct status is: PARTIALLY OPEN, IN PROGRESS. Not fully open, and not a promise that every holder can move every token today. Holders of the less-liquid tokens that make up the remaining gap are explicitly not in phase one, and Binance says other networks and assets will follow only after further security and stability checks, prioritised by user demand.

What changed overnight: 90% became 95%

The most material update in Binance’s fourth recovery update, posted early Sunday, is the replenishment figure: about 95% of the roughly $6.3 billion stolen in the October 29 attack is now covered, up from 90% a day earlier. The arithmetic behind the claim is unchanged and still entirely Binance’s own: more than $6.34 billion of company funds set aside, about $5 billion of it already held in the exact tokens that were taken, the rest bought through market and over-the-counter channels, with losses absorbed by the company and not by users. About $3 billion of the stolen assets was frozen on-chain with industry partners in the hours after the attack, including more than $1.57 billion in USDT frozen by Tether and more than $800 million in USDC frozen by Circle — a separate pool from the replenished tokens, and one whose return to Binance is not yet quantified.

The FBI’s attribution, reported by Reuters on Saturday, adds a different kind of weight: the North Korean state-sponsored unit known as TraderTraitor was blamed for the heist, described as the largest digital theft on record. Attribution restores no wallet, but it frames the recovery as a law-enforcement matter too, and raises the odds that more frozen funds stay frozen.

None of this should be read as verified fact about Binance’s wallets. Security firm CertiK has said it cannot verify the claimed $5 billion in replacement holdings without more information, including wallet addresses Binance has not disclosed. That caveat runs through the whole week: Binance’s numbers have moved in the right direction every day, and every one of them is still, for now, Binance’s word.

The tape is calm. That is informative, not decisive.

Bitcoin traded near $77,920 at the time of writing, up about 0.7% on the day, with XRP near $1.2557, up about 0.5%, after Bitcoin closed October 31 at $77,435. Ether sat near $2,266. A market that was pricing an existential exchange event would not look like this. But calm on a Sunday, on thin books, during a window that has barely opened, is a weak signal. The strong signal comes later, and it comes in flows, not prices: how much leaves Binance in phase one, how orderly the queue is, and whether outflows spike and then normalise — the pattern of a backlog clearing — or keep accelerating, which would suggest holders are still voting with their feet.

Thursday’s on-chain picture is the baseline. Exchanges recorded roughly $4.9 billion of withdrawals against $2.9 billion of deposits on the worst day of the week, a migration to custody rather than a rush to sell. If Sunday’s reopening produces a second, larger wave from Binance specifically, it confirms the trust damage is concentrated in one venue. If flows are modest, most holders who wanted to leave already left, or are content to wait for proof.

Monday: Binance’s own numbers, read with care

Monday, November 2 is when Binance has promised its proof-of-reserves results. The snapshot itself was taken at 00:00 UTC on October 31. What lands Monday should therefore be read as a statement, not as evidence: reserve ratios for the major assets, presumably at or above 100% for the ten most-held assets — Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash, which Binance already says are fully backed — presented by the party with every incentive to present them well.

Three things to check in Monday’s release, in order. First, whether the ratios cover all customer liabilities or only the ten named assets, and whether the less-liquid 5% is disclosed as a shortfall or quietly omitted. Second, whether the snapshot addresses the uncomfortable detail from CoinDesk’s review — that wallets drained in the attack had previously appeared in Binance’s reserve backing list — or leaves it to the post-mortem. Third, whether Monday’s numbers reconcile with the October 1 baseline, when major-asset ratios sat at or above 100% and on-chain reserves totalled about $135.8 billion. A statement that cannot be reconciled to its own baseline is a red flag, even before any independent check exists.

Tuesday: the proof that can actually be checked

Tuesday, November 3 is the date that matters most, and it is important to be precise about its status: the full zero-knowledge proof is expected by Tuesday according to press reporting of Binance’s timeline, with generation taking roughly 40 to 50 hours. That is a press-reported expectation, not an official confirmation that a proof has been published, and it should not be written as one until Binance’s proof-of-reserves page actually carries it.

When it arrives, the zk-SNARK/Merkle construction is what turns a claim into something a user can test: each customer should be able to verify that their own balance is included in the Merkle tree, and the proof should demonstrate that total assets cover total liabilities without revealing individual balances. The checks that matter are specific. Does the proof cover the same liability set as Monday’s statement, or a narrower one? Are the reserve wallet addresses disclosed and independently observable on-chain? Do the ratios hold asset by asset, or only in aggregate, where a surplus in one token could mask a deficit in another? And does the proof’s timestamp match the October 31 snapshot, or has the goalpost moved?

Even a clean proof has a known limit: proof of reserves shows assets at a moment in time. It does not prove liabilities are complete, nor that assets cannot leave hours later under a valid signature — the EIP-7702 delegation mechanism this attack exploited. A proof answers solvency, not security. Only the full post-mortem can begin to answer that, plus whether SAFU, drawn down to cover the loss, is restored to about $1 billion as committed.

What to do with this week

For holders, the sequence writes itself. Do not treat phase one as an all-clear: check Binance’s own withdrawal and status pages for your specific asset and network before attempting a transfer, expect delays, and beware fake “withdraw now” links flooding every reopening window. For traders, the morning levels still frame the week: short-term holder cost basis near $76,500, a reclaim zone at $79,500–80,500, and Friday’s payrolls at 20:30 Vietnam time as the macro print that could override the Binance narrative. The discipline is simpler: a claim on Sunday, a statement on Monday, and evidence — if it arrives — on Tuesday. Trust, in that order, is earned backwards.

Internal links: For the full weekly story behind this reopening, see The Week the Floor Moved: Five Central Banks, a $6.3B Hack, and Bitcoin Below $80K. For the custody question at the heart of the withdrawal queue, see Self-Custody in 2026: When to Leave the Exchange. For the data print that set the December pricing into which this recovery lands, see In Line, and It Still Broke: Core PCE Hit 3.1%, GDP Beat — and Bitcoin Lost $80K.

Follow the sequence: CoinXSight will check Monday’s statement against its own baseline and test Tuesday’s proof the day it lands — follow the Strategy desk so the verification, not just the announcement, reaches your feed.