Binance Reopens Withdrawals for Fourth Batch of Tokens in Recovery Update #9

Published November 6, 2026, 12:20 PM PKT. Based on Binance Security Incident Recovery Update #9, published November 6, 2026 (primary source), with additional reporting by CompareCEX and BBX on November 6, 2026 (secondary reporting), plus Binance Recovery Update #7, published November 4, 2026 (prior position on replenishment and proof of reserves).

Binance has begun reopening withdrawals for a fourth batch of tokens under its Security Incident Recovery Update #9, published at 03:06 UTC on November 6, 2026, with the rollout starting progressively at 04:00 UTC, or 09:00 AM PKT, across nine blockchain networks. The batch covers 58 network and asset pairs on BNB Smart Chain, Base, Ethereum, Optimism, Polygon, Arbitrum, Avalanche C-Chain, TRON and SUI, and it is the next concrete step in restoring access after the October 29 security incident in which about $6.3 billion in cryptocurrency was taken from the exchange's hot wallets. The rollout is progressive, not simultaneous, which is the detail that matters most for users checking a specific coin: Binance says each network and asset pair opens only as its security and readiness checks finish, so a token named in the update may still show as unavailable for a time, and users are told to check the withdrawal page or the exchange's network status page for their exact pair.

The November 6 batch: nine networks, 58 pairs

On BNB Smart Chain, withdrawals reopen for $USDE, $PENDLE, $ZRO, $JASMY, $BAT, $ZBT, $ENSO, $SUI, $HAEDAL, $ZAMA, $YFI, $WLFI, $SAHARA, $SAND, $EUL, $OPEN, $ANKR, $ID, $AUCTION, $MANA, $G, $ZKP, $CYBER, $F, $AXL, $JST, $SUN and $MMT. On Base, the reopening covers $ZRO, $BREV, $ZBT, $PARTI, $VIRTUAL, $MORPHO and $AXL. On Ethereum, it covers $U, $XRP, $CAKE, $LISTA, $W and $WCT. On Optimism, it covers $ETH, $ZRO, $AXL and $WLD. On Polygon, it covers $ZRO, $SAND, $AXL and $GRT. On Arbitrum, it covers $PENDLE, $ZRO, $ETHFI, $AXL and $GRT. On Avalanche C-Chain, it covers $ZRO and $AXL. On TRON, it covers $U, and on SUI, it covers $FDUSD. The best known names in the batch are Ethena USDe ($USDE) and Pendle ($PENDLE) on BNB Smart Chain, XRP ($XRP) and PancakeSwap ($CAKE) on Ethereum, Worldcoin ($WLD) on Optimism, The Sandbox ($SAND) and Decentraland ($MANA) on BNB Smart Chain, yearn.finance ($YFI) on BNB Smart Chain, and First Digital USD ($FDUSD) on SUI. Several tokens appear on more than one network, so the 58 figure counts network and asset pairs, not 58 distinct tokens, and holders should confirm the network, not just the token name, before attempting a withdrawal. Binance says it prioritized the batch by user demand measured over the past week, the same demand based method it used for the earlier phases, and that more assets will be added as they become ready.

What Update #9 does not change

Update #9 is a withdrawal reopening notice, and it does not update the money figures. It gives no new replenishment percentage and no new proof of reserves snapshot, so the last stated position still comes from Recovery Update #7, published November 4, 2026: about 98% of the affected amount replenished, with a new proof of reserves snapshot taken at 00:00 UTC on November 4 covering 44 tokens, up from 10 in the earlier snapshot. The full zero knowledge proof that lets holders of those 44 tokens verify their own balances was expected to take about 50 to 60 hours from November 4, which puts completion somewhere between about 02:00 UTC and midday UTC on November 6, and no completion announcement had been published when Update #9 went out, so readers should not treat the wider snapshot as already fully verifiable. Deposits were not affected at any point during the incident and remained open throughout, according to the recovery updates, and Binance repeats in Update #9 that it will absorb the financial impact of the stolen funds, not its users. No timeline for full restoration across all assets is given in Update #9, and no changes to trading, conversion or other platform functions are announced in it.

Where this sits in the recovery sequence

The sequence explains why this batch matters even though it is the fourth, not the first. Withdrawals began reopening in phases on November 1, starting with 15 networks and the largest assets, including Bitcoin ($BTC), Ethereum ($ETH) and major stablecoins, after Binance said it had covered about 95% of the impacted amount. A second batch followed on November 3 under Recovery Update #6, covering more assets on BNB Smart Chain, Ethereum, Solana ($SOL), XRP ($XRP), SUI ($SUI), Arbitrum, Optimism, TRON and Base. Update #7 on November 4 then moved the money story forward, to 98% replenished and a wider proof of reserves snapshot, but gave no new withdrawal list. Update #8 on November 5 reopened a third batch of 69 network and asset pairs across six networks, and Update #9 now moves the access story forward again, for the smaller and mid sized tokens that had remained locked while the headline assets reopened. During the rollout, Binance warns, withdrawals may be delayed or take longer because of traffic, and if a withdrawal fails, users are asked to retry after a short while. That warning, plus the progressive rollout, means the practical test of Update #9 is not the announcement time but whether each named pair actually opens during November 6. Bitcoin ($BTC) traded near $76,000 on November 6, according to exchange market data, after the selloff that took it below $77,000 the day before.

The incident behind the recovery

The recovery updates all trace back to the October 29 incident, which Binance has described in its initial investigation as starting with a compromised DevOps engineer's laptop that gave an attacker access to a service container, from which unauthorized withdrawal transactions were submitted. Binance has said there is no evidence of a wallet private key leak, that about $3 billion of the stolen funds was frozen on chain through coordination with blockchain partners, and that a full technical post incident report is still pending. The U.S. Federal Bureau of Investigation attributed the attack on October 31 to North Korea linked TraderTraitor operatives, according to earlier reporting on the incident. None of those points is updated by Update #9, and the pending items remain the same: the full post incident report, the completed zero knowledge proof for the 44 token snapshot, and a date for full withdrawal restoration across all remaining assets.

Sources

• Binance, Security Incident | Recovery Update #9: Withdrawals for More Assets to Reopen (2026-11-06), November 6, 2026 (primary source: published 03:06 UTC November 6, rollout from 04:00 UTC November 6, nine networks, full asset lists, demand based prioritization, deposits open, no new coverage or proof of reserves figures)
• CompareCEX, Binance hack Oct 2026: fourth withdrawal batch reopens (Update #9), November 6, 2026 (secondary reporting: Update #9 announced 03:06 UTC November 6, fourth batch from 04:00 UTC November 6, nine networks, full asset table, no new coverage, proof of reserves or post-mortem details; tracks the full update sequence from the October 30 incident notice through Update #8)
• BBX, Binance will gradually reopen withdrawals for some assets starting at 12:00 on November 6th, November 6, 2026 (secondary reporting: Recovery Update #9 restores withdrawals in stages from 12:00 Beijing time November 6 after security checks, deposits normal, prioritization by user demand over the past week, delays possible during rollout)
• Binance, Recovery Update #7: 98% of Stolen Assets Replenished and New PoR Snapshot With Expanded Coverage (2026-11-04), as tracked by CompareCEX, November 4, 2026 (primary prior position: about 98% replenished, snapshot at 00:00 UTC November 4 covering 44 tokens, full zero knowledge proof expected in about 50 to 60 hours)

This article is news reporting and is not investment advice.