Binance net outflows reach $3.64B after $6.3B hack as withdrawals resume

What happened

Binance handled $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC on Nov. 1, 2026, according to figures reported by Bitcoin.com News and Blockonomi. The nine-and-a-half-hour window left roughly $3.64 billion in net outflows, or about 2.1% of the $171 billion in assets under management cited in Binance's proof-of-reserves data.

The exchange began restoring withdrawals in phases at 06:00 UTC. By 12:36 UTC, the initial phase covered all 15 networks and assets, including Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, XRP Ledger and Arbitrum. Binance said withdrawal volumes fell and were stabilizing after an initial spike, while deposits stayed available throughout the recovery.

Activity data presented in 30-minute intervals showed the heaviest withdrawal period early in the restart: a $733 million peak in the interval starting at 08:00 UTC. Deposits peaked at $187 million at 08:30 UTC, and net flows remained negative in every interval shown. Reuters separately cited DefiLlama data showing more than $3.5 billion in Sunday net outflows, a measure that broadly matched Binance's own figure.

Why it matters

The outflow figure gives a concrete measure of customer movement after the hack and shows that incoming deposits did not fully offset withdrawals. At 2.1% of reported assets under management, the net withdrawals represented a meaningful share of the exchange's stated holdings, and the reports frame the numbers as a significant movement of customer funds without showing uninterrupted acceleration. The data also indicates that the reopening was gradual and that demand was concentrated near the start, with smaller volumes later in the window. For Binance, the test is whether withdrawals continue to stabilize as more assets and networks return and as reserve verification catches up with the post-hack period.

What the data shows

The withdrawal total of $4.649 billion and deposit total of $1.01 billion produced net outflows of approximately $3.64 billion over 9.5 hours, not a full day, according to the reports. Binance compared the net figure with $171 billion in assets under management from proof-of-reserves data dated Oct. 28, yielding the 2.1% share. The 30-minute charts showed a $733 million withdrawal peak at 08:00 UTC and a $187 million deposit peak at 08:30 UTC; every interval recorded net outflows.

Restored routes covered BTC on Bitcoin; XRP on XRP Ledger; DOGE on Dogecoin; ETH, USDT and USDC on Ethereum; BNB, USDT and USDC on BNB Smart Chain; ETH and USDC on Base; ETH, USDT and USDC on Optimism; ETH, USDT, USDC and ARB on Arbitrum; SOL, USDT and USDC on Solana; ZEC on Zcash; USDT and GRAM on TON; SUI on Sui; TRX and USDT on Tron; POL, USDT and USDC on Polygon; and AVAX, USDT and USDC on Avalanche C-Chain. Binance also restored bitcoin transfers to external addresses and warned that traffic could temporarily delay processing.

Background

The withdrawals followed an October 29 hot-wallet breach that Binance has described as a $6.3 billion hack. In an October 30 update, the exchange said a compromised engineer's laptop may have enabled unauthorized transactions through a service container, and investigators had not identified leaked private keys. On October 31, the FBI attributed the theft to North Korea's TraderTraitor operation and said stolen assets were being converted primarily into ether; the bureau also warned that decentralized finance services could facilitate laundering.

Binance said it froze about $3 billion in stolen assets with partners and replenished roughly 95% of affected token balances using company resources, up from a previously disclosed 90%. That replenishment measured replacement of affected assets, not funds returned by attackers. Its fourth recovery update said ten major assets, including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, were fully backed.

What to watch

Binance said it would publish a post-incident report when its investigation concludes. A new reserve snapshot was taken at 00:00 UTC on Oct. 31, with an updated report expected Nov. 2, according to Bitcoin.com News; Blockonomi reported that the accompanying zero-knowledge proof was still being calculated and publication was expected Nov. 3. Because the snapshot preceded the Nov. 1 withdrawals, it did not capture subsequent reserve changes, Blockonomi noted. The exchange also said it was continuing to test networks and assets outside the initial phase and was buying less liquid tokens through market and over-the-counter channels. Customers could still face delays as remaining services return.

Questions readers ask