Withdrawals are returning in phases
Binance has started restoring withdrawals after the security incident that it estimates affected approximately $6.3 billion in assets.
The exchange's fourth recovery update scheduled the first phase between 06:00 and 09:00 UTC on November 1. It covers selected assets across 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, Tron, XRP Ledger, Zcash, Dogecoin, TON, Polygon, Avalanche, Arbitrum, Base, Optimism and Sui.
Availability is progressive rather than simultaneous. Binance co-founder Yi He later confirmed that ETH, USDT and USDC withdrawals on Ethereum, and BNB, USDT and USDC withdrawals on BNB Smart Chain, had reopened. Lookonchain separately observed resumed BTC withdrawals on the Bitcoin network.
Binance warns that traffic may cause delays and says users should check the withdrawal or network-status page for the exact asset and network pair. Deposits remain open, according to the exchange.
Binance says replenishment has reached 95%
Binance now says it has replenished approximately 95% of the affected assets, up from 90% in its previous update and 80% in the update before that.
It says balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed and viewable through its Proof of Reserves snapshot. The remaining 5% consists of less-liquid tokens that the exchange says it is still sourcing through market and over-the-counter channels.
These are Binance's figures. Replenishing customer balances is not the same as recovering stolen funds: the company can replace missing assets with its own resources while the attacker continues moving the original assets.
An attributed wallet is moving SOL toward BTC
That distinction is visible on-chain. Lookonchain reported that a Solana address attributed to the Binance attacker held 970,522 SOL, valued at approximately $95.9 million at the time of its post.
The researcher said the address moved 486,970 SOL, then worth about $46.4 million, within an hour and was using Relay to swap SOL toward BTC. The address and its transfers are publicly reviewable through the linked explorer, but the cited dollar values are time-sensitive estimates rather than fixed proceeds.
The activity is directionally different from the ETH conversion highlighted in the FBI's latest warning. It shows that assets attributed to the incident are being moved across more than one route and into more than one censorship-resistant asset.
Andy, who surfaced the update, speculated that US authorities could ask Relay to restrict the activity. No such request from the FBI or another agency has been published, and Signal21 is not presenting that prediction as fact.
What the two developments mean
For Binance customers, the operational position has improved: withdrawals are returning and the exchange says most affected balances have been replenished. The rollout is not complete, and every asset-network pair remains subject to separate checks.
For investigators and infrastructure providers, the laundering problem is broadening. The FBI has already asked DeFi services, instant exchanges, node operators and analytics firms to block transactions linked to its TraderTraitor address list. Whether Relay can identify, pause or restrict these specific swaps has not been established publicly.
The precise status is now: Binance has begun restoring withdrawals and says 95% of affected assets are replenished. Separately, public transaction tracking indicates an attributed attacker wallet is converting part of a 970,522-SOL position toward BTC through Relay. The service recovery and the movement of stolen assets are happening at the same time.
Follow Signal21's complete Binance incident timeline for the breach, freezes, attribution, replenishment and withdrawal updates.
This is a developing story. Signal21 will update the coverage if Binance expands withdrawals, Relay responds or law enforcement publishes additional measures.
This publication is market analysis, not a recommendation to buy or sell.