My last two articles covered the Binance hack itself, then Binance's own report that it was a six-month break-in. This week the story moved again, in two directions at once: withdrawals keep reopening, batch by batch — and traders keep leaving anyway.
Recovery Update #9: a fourth batch, today
Binance posted "Recovery Update #9" on November 6 at 03:06 UTC. Withdrawals reopen for a fourth batch of tokens from 04:00 UTC the same day, rolled out progressively — not all at once — across BSC, Base, ETH, Optimism, Polygon, Arbitrum, AVAX C-Chain, TRX and SUI. Deposits stay open.
The batch is mostly smaller and mid-cap tokens this time, prioritised by user demand over the past week: on BSC, USDE, PENDLE, SAND, MANA, YFI, WLFI and others; on ETH, XRP, CAKE and LISTA; on Optimism, ETH and WLD; plus ZRO and AXL across several networks. The full list is on Binance's announcement and network status page — check your exact token *and* network there, because a token reopening on one chain does not mean it has reopened on another.
This update gives no new coverage figure, no new Proof of Reserves snapshot and no post-mortem. The last figures on those stand from Update #7 on November 4: about 98% of the stolen amount replenished, and a Proof of Reserves snapshot taken November 4 at 00:00 UTC covering 44 tokens, up from 10.
The pattern of the recovery is now clear, and it is worth stating plainly: Binance is reopening withdrawals in daily batches — November 1, 3, 5 and now 6 — each time for the assets its security checks have cleared, each time with a warning that withdrawals may be delayed and that a failed attempt should simply be retried after a short while. That is a recovery working as designed. It is also a recovery that is still, a week after the theft, not finished. On Friday Binance added a target date: HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of next week, and all tokens on already-restored networks by then.
The other direction: market share is slipping
While withdrawals reopen, Binance's share of trading is falling. Data from Kaiko, reported on November 4, shows Binance accounted for about 42% of spot trading volume across the top-10 platforms over the past seven days — down from around 48% before the hack, and roughly 51% in mid-August. It is the exchange's lowest share in at least 12 weeks.
The volume did not vanish; it moved. OKX's share rose to about 14% over the same period, up from about 11% the prior week, and Coinbase's grew to 9.6% from about 9%.
The money movement tells the same story. Customers have pulled a net $5.6 billion since withdrawals reopened — about 3.5% of Binance's total assets, according to a Binance spokesperson. That is up from the $4.6 billion in withdrawals against $1 billion in deposits in the first morning alone. There is a counter-signal too: by around 03:00 UTC on November 3, hourly deposits began exceeding hourly withdrawals, which Binance reads as flows normalising. Both things can be true at once: the panic outflow has slowed, and a meaningful slice of trading has still gone elsewhere.
What this means if you hold crypto anywhere
Three lessons, all free, all drawn from this week's two directions:
1. "Reopened" is not "back to normal" — check your asset, not the headline. A fourth batch reopening does not mean your token is in it. Before you try to move anything, check the official announcement for your token and network, expect delays during the rollout, and retry once after a short wait if it fails. Do not pay anyone offering to "speed up" your withdrawal, and do not click any "recovery" link in a DM or email — fake recovery sites were already the trap in the first days after the hack, and a new batch of reopenings is a new excuse for them.
2. Trust is priced in market share, not in press releases. Binance says it has covered the losses and that user funds are safe, and the numbers so far support that: 98% replenished, billions frozen, withdrawals flowing again. Traders are still moving some volume to rivals. That is not a verdict that Binance is unsafe — it is a reminder that confidence, once shaken, recovers more slowly than withdrawals do. When you choose an exchange, you are choosing both its balance sheet and its reputation, and both took a hit here.
3. The habit that survives every update: keep only trading money on an exchange. This is the same lesson as my last two articles, and the recovery week is the proof of it. The users hurt worst by a phased reopening are not the ones who lost money — Binance says it is absorbing the loss — but the ones whose funds were frozen in place while they waited for their batch. Anything you would hate to be unable to touch for a week belongs in a wallet you control, not on any exchange, however large.
The zero-capital version, again
I do not use Binance — it does not serve US users — and my Publish0x balance is still measured in cents. None of this week's batches changes that. But the recovery is the most useful free lesson in this whole story for a small holder: watch how an exchange behaves in the week *after* the hack, not just the night of it. Daily batches, a widening Proof of Reserves snapshot, deposits overtaking withdrawals again — and, at the same time, market share slipping to rivals. A platform can be paying its losses and losing its traders at the same time. The habits that protect you from both halves of that — official sources only, your own wallet for anything meaningful, never everything in one place — cost $0, and they work whether the next headline is a reopening or another breach.
