Binance withdrawals reopen: $3.64bn net outflow in the first 9.5 hours

Binance withdrawals reopened on Sunday 1 November, 58 hours after the hack froze them, and customers pulled $4.649 billion in the first nine and a half hours. Between 06:00 and 15:30 UTC the exchange also took in $1.01 billion of deposits, so the net outflow came to $3.64 billion, Binance said on X, as reported by CNBC. That is 2.1% of the $171 billion in customer assets in its 28 October proof of reserves.

Where the money went

• The largest single interval in Binance's data started at 08:00 UTC: $733 million out.
• Deposits peaked at $187 million at 08:30 UTC.
• USDT led withdrawals, then USDC and bitcoin.

DefiLlama tracks Binance's on-chain wallets more widely. It shows $5.8 billion of net outflows over 24 hours, and total exchange assets down from about $144.9 billion on 29 October to $128.3 billion early on 2 November, per Bitcoin.com.

By our count, take out the $6.3 billion stolen and about $10.3 billion of that drop is left. Price falls and withdrawals share it, and DefiLlama does not split the two.

Competitors caught little of it. The on-chain tracker Whale Factor counted about $4.5 billion leaving Binance in 24 hours, while the next ten exchanges together gained $368 million, OKX the most. That is about 8%, and the rest went to private wallets and other destinations.

Changpeng Zhao answered with "98% choose to stay!" on X. His number mirrors the 2.1% share of assets that left. Binance has not said how many customers withdrew.

What works again

Bitcoin came back first, between 06:00 and 09:00 UTC. By 12:36 UTC all 15 networks of the first phase were open: Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP Ledger, Tron, TON, Base, Optimism, Arbitrum, Polygon, Avalanche C-Chain, Sui, Dogecoin and Zcash. Deposits stayed open throughout.

Binance said other assets "will be added once they are ready" and has not named a date for the next phase. If your coin sits on a network outside that list, you still cannot move it off the exchange.

What Binance promises next

Binance says it has covered 95% of the stolen amount, up from 80% on Friday and 90% on Saturday, from its treasury, the SAFU fund and the futures insurance fund. Ten assets are fully backed: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 5% sits in less liquid tokens that Binance is still buying on the market and over the counter.

“Our top priority right now is to ensure the environment is secure.”

— Yi He, co-CEO of Binance, as quoted by TokenPost · tokenpost.com

The plan the leadership has made public so far:

• Full operations return only after security checks, co-CEO Yi He said.
• A full zero-knowledge proof of reserves by Tuesday 3 November UTC. Teng had promised it for Monday; Binance says the proof takes 40 to 50 hours to compute.
• SAFU goes back to about $1 billion.
• A post-incident technical report once the investigation ends.

Co-CEO Richard Teng says the company is "taking a cautious approach to ensure services are restored securely". Binance has also found "additional points of breach" beyond the engineer's laptop it blamed first, and it has not named a root cause. The FBI attributes the attack to North Korea's TraderTraitor.

South Korea's Financial Services Commission ran an emergency review of local exchanges, checking access to IT systems and the approval and signing of hot wallet withdrawals. The attacker abused exactly that layer at Binance.

Tuesday's proof is the next check you can run yourself: it lets each customer confirm that their balance sits in the liabilities Binance reports.

Not investment advice. Flow figures: Binance via CNBC, DefiLlama and Whale Factor via Bitcoin.com.