Binance $3.64 Billion Outflows Test Trust After Record $6.3 Billion Hack

Binance customers pulled a net $3.64 billion from the world's largest cryptocurrency exchange on Sunday, November 1, 2026, as withdrawals resumed after the record $6.3 billion hack that shook digital-asset markets last week. The Binance $3.64 billion outflows figure, reported by the exchange itself, is the first hard measure of how much trust survived the biggest crypto theft on record — and, by Binance's own telling, the answer is reassuring: the exit amounted to just 2.1% of the company's assets.

Key Points

• Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC on November 1, for net outflows of $3.64 billion.
• The net exit equalled 2.1% of Binance's $171 billion in total assets, based on proof-of-reserves data dated October 28, 2026.
• Binance said withdrawal volumes spiked at first and then stabilised, while deposit volumes remained substantial.
• The exchange says it has now covered about 95% of the $6.3 billion stolen, with the remaining 5% in less liquid tokens taking longer to replace.
• Independent tracker DefiLlama put outflows higher, a gap Binance blamed on its own deposits to a new hot wallet not being counted.

What Happened

Binance began restoring withdrawals in phases at 06:00 UTC on Sunday, three days after hackers drained about $6.3 billion from its hot wallets on Thursday, October 29. By 12:36 UTC, withdrawals had resumed for all 15 networks and assets in the first phase, including bitcoin, ether, BNB, Solana, XRP and dogecoin, as well as some USDC and USDT stablecoins. The company said it was prioritising tokens based on the previous week's user demand.

The first nine and a half hours produced the numbers that now define the episode. Between 06:00 and 15:30 UTC, customers withdrew $4.649 billion and deposited $1.01 billion, Binance said in a post on X. The resulting net outflow of $3.64 billion was measured against $171 billion in total assets under management, the figure from Binance's latest available proof-of-reserves data as of October 28. Founder and former chief executive Changpeng Zhao, known as CZ, framed the same numbers as a vote of confidence, writing on X: "12 hours after withdrawals resumed: 2.1% net outflow, with most occurring in the first couple of hours," and adding, "98% choose to stay!"

Binance said the pattern matched its expectations. "After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial," the exchange said. It cautioned, however, that the reopening was not complete: testing was continuing for the remaining networks and assets, and reports on Sunday showed many smaller tokens still suspended or only partly restored while the first-phase assets traded normally.

Background/Context

The theft itself unfolded with startling speed. The bulk of the roughly $6.3 billion was drained in around 20 minutes beginning late on Thursday, October 29, according to blockchain analysis firms TRM Labs and Chainalysis. It surpassed every previous crypto heist and added to a grim run for the industry: attackers stole $2.9 billion across nearly 150 incidents last year, according to TRM Labs, and the same North Korea-linked group was blamed last year for the then-record $1.5 billion theft from Bybit.

On Saturday, October 31, the FBI gave the attack its first official United States government attribution, identifying the North Korean state-sponsored unit known as TraderTraitor as responsible for the theft of more than $6 billion in virtual assets from Binance. The FBI said it had observed members of the unit converting stolen assets into ether and expected further laundering. Pyongyang has for years denied using state-linked cyber units for financial theft. US President Donald Trump, speaking to reporters on Saturday, struck a more cautious note, saying: "We don't know if it's North Korea — but if it is, we'll talk to North Korea about it."

Binance, which was founded in China and says it has 335 million registered users globally, has repeatedly promised to absorb the financial impact rather than pass losses to customers. It said earlier on Sunday that it had covered $6 billion of the stolen cryptocurrencies by using company money to buy replacement tokens, and it has set aside around $6.34 billion of company funds to cover the losses. The money came from its $1 billion Secure Asset Fund for Users, known as SAFU, a bitcoin reserve held to protect customers after security breaches, as well as some of its Futures Insurance Fund and its corporate treasury. Co-chief executive Yi He said on Saturday that Binance would use 50% of its SAFU funds, while the company committed to replenishing the fund to about $1 billion.

Binance $3.64 Billion Outflows: What the Numbers Really Show

The headline number invites two very different readings, and both contain some truth. On Binance's own accounting, a 2.1% net outflow after the largest hack in crypto history is a strikingly small exit — evidence, the company argues, that most customers treated the breach as Binance's problem to fix, not as a reason to leave. The deposit figure supports that reading: more than $1 billion flowed back in during the same nine-and-a-half-hour window, even as withdrawals surged.

The counter-reading comes from the independent data. Crypto analytics platform DefiLlama's dashboard showed outflows higher than Binance's net figure — $4.36 billion in the account carried by Reuters. Binance disputed that measurement, saying: "This figure does not contain the flows we have deposited to our own new hot wallet, so they are not accurate. Our last update on X is closest to accurate." The dispute is technical but important: gross withdrawals and net customer exits are different things, and a platform moving its own funds between wallets can inflate a gross-outflow count. What is not in dispute is that the first hours saw a rush for the exits, concentrated in the first couple of hours, before volumes settled.

There is also what the numbers do not yet show. The $3.64 billion covers only the first phase of a phased reopening. Customers holding tokens outside that first group could not all leave at once, so the true test of confidence will play out over days, not hours, as the remaining networks come back online. Bitcoin, for its part, held up comparatively well, trading near $78,000 on Monday, according to CoinDesk — a sign, analysts said, that deep institutional presence is absorbing shocks that once would have crashed the market.

Reactions/Quotes

Binance's leadership moved quickly to frame the reopening as a success. "Trust isn't earned by what you say in good times. It's earned by what you do in hard times," Zhao wrote on X, alongside his "98% choose to stay!" message. Co-chief executive Richard Teng, who has described the breach as a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity, had earlier said the company would fully cover the losses.

Zhao also publicly thanked US law enforcement, writing that the FBI, the US Secret Service, the IRS and other agencies "provided vital help in this incident, including tracking, freezing, etc." He added: "A tweet can't fully express our gratitude. Many crypto bros may not realise, a lot of the 'why bitcoin didn't drop more?' credit goes to them." Binance said it had been working with other crypto firms to freeze some of the affected assets, with about $3 billion located as of Friday. Stablecoin issuer Circle separately told CNBC it had activated its incident response procedures and coordinated with law enforcement to freeze more than $1.1 billion in USDC associated with the incident, up from more than $800 million on Friday.

Why It Matters

For ordinary crypto holders, this episode is a stress test of the centralised exchange model itself. Binance is not a small platform: it is the world's largest crypto exchange, with 335 million registered users and $171 billion in assets under management. If customers had fled en masse, the damage could have cascaded through prices, lending and the stablecoins that grease crypto trading. That a net exit of 2.1% was the worst of the first day is, in that light, a meaningful result for market stability — even if it says nothing yet about the slower decisions customers make over the coming weeks.

For regulators and law enforcement, the FBI attribution raises the stakes beyond one company's balance sheet. A state-sponsored theft of $6.3 billion, if the attribution holds, is not ordinary cybercrime; it is sanctions evasion and revenue generation by a hostile state, laundered through the global financial system. The freezing of more than $1.1 billion in USDC shows how stablecoin issuers have become front-line enforcers in that fight, able to halt tainted funds in ways traditional banks cannot match for speed.

For the wider market, the timing matters. The hack landed in a week already dominated by the US midterm elections on November 3, a brutal October sell-off in technology shares, and anxiety about artificial-intelligence spending. Crypto's relatively contained reaction — bitcoin near $78,000 on Monday rather than in free fall — suggests the market now distinguishes between a single exchange's security failure and the value of the assets themselves. That distinction, if it holds, is itself a sign of how far the industry has matured since earlier exchange collapses wiped out customers entirely.

What Happens Next

Three things will decide whether the $3.64 billion outflow was the peak or just the first wave. First, Binance must finish restoring the remaining networks and assets, including tokens such as Cardano, Chainlink, Hyperliquid, Litecoin and NEAR that were still being tested on Sunday. A smooth completion would reinforce the stabilisation story; fresh delays would revive doubts. Second, the company must source the remaining 5% of stolen tokens — the less liquid assets it says take longer to replace — and replenish SAFU to about $1 billion as promised. Third, investigators must show whether the frozen $3 billion-plus in assets can actually be recovered, or whether, as the FBI warned, further laundering through ether and related technology puts much of it beyond reach.

Market watchers will also be watching bitcoin's range. Analysts cited by CoinDesk suggested that if withdrawals continue smoothly, bitcoin could stabilise at $76,000 to $80,000 this week and head back toward $82,000 by the weekend. A break below that range, or a second surge in Binance outflows as more tokens reopen, would tell a different story. Either way, the $3.64 billion figure from November 1 will remain the benchmark against which every later update is judged.

Frequently Asked Questions

How much money left Binance on November 1? Customers withdrew $4.65 billion and deposited $1.01 billion between 06:00 and 15:30 UTC, leaving net outflows of $3.64 billion, according to Binance.

What share of Binance's assets was that? The net outflow equalled 2.1% of Binance's $171 billion in total assets under management, based on proof-of-reserves data dated October 28, 2026.

Has Binance covered the $6.3 billion hack? Binance says it has covered about 95% of the stolen amount using company funds, including its SAFU reserve, Futures Insurance Fund and corporate treasury. The remaining 5% consists of less liquid tokens that take longer to source.

Who does the FBI blame for the hack? The FBI attributed the October 29 theft to TraderTraitor, a North Korean state-sponsored unit. President Donald Trump said on Saturday that it remained unclear whether North Korea was involved.

Are all Binance withdrawals working again? Not yet. The first phase of 15 networks and assets resumed on November 1, but Binance said testing was continuing for the remaining networks and assets.

Related coverage: FBI blames North Korea for $6.3 billion Binance hack, Binance withdrawals resume as 95% of hack losses covered, and Magnificent Seven debt hits $578 billion as AI spending raises alarm.