Binance recorded $3.64 billion in net outflows after withdrawals reopened

After Binance began restoring withdrawals on Sunday, it reported $3.64 billion in net outflows, following a $6.3 billion hack.¹ From 6 a.m. to 3:30 p.m. UTC on Nov. 1, customers withdrew $4.65 billion while deposits brought in $1.01 billion.¹ Those two gross flows describe activity in opposite directions during the same period; the reported net-outflow figure is the exchange’s summary of the movement after reopening.¹ Using its proof-of-reserves figures available for Oct. 28, Binance said the net outflow represented 2.1% of its $171 billion in total assets.¹ That comparison gives the withdrawal figure a denominator: it is measured against reported total assets, rather than presented as the amount of the hack or the value of all customer holdings withdrawn.¹

The reopening was staged rather than completed in one step: Binance started restoring access at 6 a.m. UTC on Sunday.¹ At 12:36 p.m. UTC, the exchange said service had returned across the 15 networks and assets included in the initial phase, while work continued on the others.¹ The first phase covered 15 crypto assets, among them bitcoin, ether, XRP and dogecoin, according to a separate report.³ That account also said bitcoin withdrawals returned shortly after 0600 GMT, with ether, BNB and some USDT and USDC stablecoin withdrawals restored as well.³ Another report described bitcoin, ether and some stablecoin withdrawals as available on Sunday, with other withdrawals expected to return in stages.³ The distinction matters: restoration for the initial group did not establish that every network and asset was ready, a supported reading of the phased timetable.¹

The measured outflow covers the stated window on Nov. 1, not every withdrawal made after the exchange reopened or a count of customers who left.¹ The reports provide dollar values for withdrawals and deposits, but do not give a customer count for the $3.64 billion movement.¹ Changpeng Zhao, Binance’s founder and former chief executive, said on X that 98% of users chose to remain, and that most net outflows occurred in the first couple of hours after service returned.¹ That user-retention statement is distinct from the dollar-denominated flow: the reports do not specify the number of users behind the percentage or equate it with a share of assets.¹ The exchange said withdrawals eased and were stabilising after an early surge, while deposits continued at substantial levels.¹ The South China Morning Post also reported Binance’s account that withdrawals were stabilising and deposits remained substantial.²

Binance said it would bear the financial effect of the stolen funds itself, rather than transfer those losses to users.¹ The exchange said it had made up around 95% of the impacted amount, an increase from the 90% figure in its previous update.¹ DealStreetAsia reported Binance’s statement that 95% of the $6.3 billion in tokens taken from the platform had been covered.⁴ Binance said the unaddressed 5% involved tokens with lower liquidity, which would take longer to obtain in the necessary quantities.¹ The exchange separately said it had covered $6 billion of stolen cryptocurrency by purchasing replacement tokens with company funds.³ Those statements describe the company’s reported response to the theft; the reports do not say that coverage meant every affected token had already been replaced.¹³

Binance said it had located about $3 billion of affected assets by Friday, working with industry partners to freeze some of them.³ It had also earmarked around $6.34 billion in internal company funds to address the losses.³ The replacement purchases drew on the SAFU reserve, the Futures Insurance Fund and corporate treasury, according to Binance’s account.³ Co-CEO Yi He said half of SAFU’s funds would be used and that Binance had pledged to restore the fund to about $1 billion.³ The figures refer to different parts of the response: located assets, internally reserved money, sources used for replacement purchases and the planned SAFU replenishment are not interchangeable measures.³

The FBI attributed the hack to North Korean hackers and named the operation TraderTraitor.¹ In a separate report, the bureau was described as identifying TraderTraitor as a North Korean state-sponsored unit responsible for the attack.³ The FBI said investigators had seen members of the unit converting stolen assets into ether and expected additional laundering using related technology.³ Binance thanked the FBI on X, in a post that quoted the bureau’s statement about North Korea’s involvement.³ Zhao said U.S. law enforcement agencies helped by tracking stolen assets and freezing some of them.³ President Donald Trump, however, said the United States was not certain North Korea had been involved; the reports therefore distinguish the FBI’s attribution from the president’s stated uncertainty.¹³

Co-CEO Richard Teng characterised the breach as a complex incident involving a compromised laptop and malicious software intended to erase evidence.³ TRM Labs and Chainalysis said most of the theft occurred in around 20 minutes late on Thursday.³ That account concerns how quickly the bulk of the theft took place, while the later withdrawal figures concern customer activity after access began returning.¹³ The South China Morning Post reported that analysts considered the stolen assets a possible record-setting financial theft.² That characterization is attributed to analysts and framed as a possibility in the report, rather than as a confirmed ranking.²

Binance’s customer and custody figures provide additional scale, but they are dated differently from the proof-of-reserves comparison used for the outflow.¹³ The exchange reported 335 million registered users worldwide and about $162.8 billion in assets under custody in its 2025 annual report.³ Registered users are a user count, while assets under custody are a dollar measure; neither figure is the same as the $171 billion total-assets figure cited from proof-of-reserves data as of Oct. 28.¹³ The reports do not establish that every registered user held assets or that all assets under custody were exposed to the same withdrawal activity.¹³ This context helps keep the measures separate: the reopening outflow, total assets, custody assets and registered users describe different things.¹³

The event joined a large reported theft to a rapid but staged restoration of withdrawal access and substantial movement in both directions during the measured period.¹ Binance said the outflows had begun to stabilise and that deposits remained strong, while Zhao said most of the net movement came soon after withdrawals resumed.¹ Its stated response combined locating and freezing some affected assets, buying replacement tokens and setting aside company resources, alongside a commitment not to pass the loss to users.¹³ The coverage statements also left a stated remainder: Binance said less-liquid tokens made up 5% and would take longer to source in the required quantities.¹ Taken together, the reports document the scale of withdrawals during a defined interval and the company’s account of its response, while leaving distinct the unresolved token sourcing and the differing public assessments of attribution.¹³