Aniplus previously announced that the first phase of withdrawal services was scheduled to start from 06:00 to 09:00 on November 1st UTC. Following the end of this period, an official update indicated that withdrawals began to gradually resume from 06:00 UTC. By 12:36 UTC, all 15 networks and their associated assets that were affected in the first phase had been fully restored; however, the remaining networks and assets are still under strict testing. The next phase of withdrawal services will be announced later. Users will not face a unified reactivation of all services, but rather a list of assets and networks that will be gradually made available one by one.
This recovery occurred after a security incident that led to the suspension of withdrawals. Binance stated that during the suspension period, the team needed to control losses, assess the impact, inspect the withdrawal infrastructure, replenish affected assets, and work with law enforcement agencies and industry partners to track the funds. The deposit service remained open, while withdrawals had to be resumed in batches after safety and operational checks were completed.
For users, the term "restored" in the announcement title is most likely to cause misunderstandings. The fact that the first 15 networks have been restored does not mean that all networks are now open; Binance still requires users to check their specific assets and network status on the withdrawal page or network status page. Due to initial traffic and batch releases, there may be temporary delays, so there is still a need for a real-time check between "the first batch has been restored" and "I can now withdraw my assets."
95% of it refers to asset replenishment, not service progress.
In its fourth round of recovery updates, Binance stated that it had covered approximately 95% of the affected amounts, which is higher than the 90% in the previous round. According to Binance, balances with the labels BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC have received 100% compensation, and users can view snapshots of their compensation proofs.
Approximately 5% remains concentrated in tokens with lower liquidity that are not among these ten major assets. Binance stated that they continue to make purchases through both market and over-the-counter channels. There are two different aspects to consider: whether the assets have been replenished, which is a matter of liabilities and reserves; and whether a particular blockchain has reopened withdrawals, which involves wallet, network, and security checks. Confusing these two aspects into one percentage can lead to the misconception that 95% of services have been restored or that only 5% of users are affected. The announcement does not support either of these interpretations.
Similarly, 100% support for the main assets does not mean that the investigation of the incident is over. Reserve snapshots are used to display addresses and balances, but they cannot replace a comprehensive explanation of the attack path, internal controls, and subsequent rectifications. Binance has promised to release an incident report after the investigation is completed, which means that what the public is seeing at present is still information from the recovery phase, rather than the full picture of the incident.
Official subsequent data also provided the actual traffic after the first phase of restoration: from 06:00 to 15:30 on November 1st, UTC, the platform processed withdrawals of $4.649 billion and deposits of $1.01 billion, with a net outflow of approximately $3.64 billion. Binance stated that the volume of withdrawals increased in the initial phase before gradually declining and stabilizing. These figures can prove that the first phase of the restoration process did indeed take place, but they cannot replace users' real-time verification of the network's status, nor can they confirm that the remaining network has been fully restored.
Phased release is about re-establishing operational boundaries.
When an exchange suspends withdrawals, the most direct loss for users is the inability to move their assets. Even if the account page still shows a balance, and users cannot transfer their assets to self-managed wallets, other platforms, or on-chain protocols, the actual control over their funds is reduced. Therefore, restoring withdrawals is not only about the technical service being restored but also about the platform returning users' ability to act again.
However, opening all networks at once would reintroduce unexcluded risks into the system. Since the wallet structures, signing processes, and node statuses vary across different chains, the security team needs to verify each one separately. Binance has chosen to open them in batches based on demand and verification results. The downside is that the user experience may not be consistent, but the advantage is that abnormalities can be observed within a smaller scope, allowing for further adjustments.
This arrangement also shifts part of the verification responsibility back to the users. Those preparing to transfer funds cannot rely solely on the status "restored" shown on social media; they must also confirm the currency, network, and address format to ensure they match the current status. If the page indicates that the service is not yet available, submitting repeatedly or switching networks may increase operational risks. The announcement allows for initial delays, which means that a "successful submission" still needs to be verified separately on the blockchain.
The losses will be borne by the platform, but trust still relies on subsequent evidence.
Binance once again promises that the financial impact of the stolen funds will be borne by the company and will not be passed on to users. Using company resources to replenish assets is a necessary measure to restore solvency and user confidence; the progress from 80%, 90% to about 95% also demonstrates that the replenishment process is advancing.
However, the restoration of trust does not depend solely on replenishing the balance. Users also need to know how the attack occurred, which controls were compromised, which wallets and permissions were altered, when the remaining illiquid assets will be replenished, and when the entire network will pass the checks. Binance currently only promises to release a report after the investigation is completed and has not provided answers to all of these questions in this update.
Therefore, this node should be understood as 'the first batch of withdrawal capabilities has been restored, and the subsequent recovery process is still ongoing,' rather than the event being completely over. The 95% mentioned refers to the asset coverage progress reported by Binance itself; the first 15 networks described represent the operations that have already been recovered. The recovery of the remaining networks, the remaining low-liquidity assets, and the investigation into the incident are not yet fully completed.
After the security incident, the most significant change in the relationship between exchanges and users occurred regarding the withdrawal button. The balance figure represents the platform's debt to the user, and only when funds can be successfully withdrawn does it mean that the user regains that choice. Binance has already opened withdrawals for the first 15 networks, but the rest are still in testing; until all networks are restored, remaining assets are replenished, and the incident report is made public, recovery will remain a process, rather than a simple statement of completion.
