Binance Sees $3.64 Billion in Net Outflows as Withdrawals Resume

Published November 2, 2026. Binance reopened withdrawals in stages on November 1 after suspending them following a $6.3 billion theft from its hot wallets. The exchange said customers withdrew $4.649 billion and deposited $1.01 billion during the first nine and a half hours, leaving net outflows of $3.64 billion. The figure is large, but it needs context: Binance said it held $171 billion in assets as of October 28, making the reported net outflow about 2.1% of that total. The return of withdrawals is an operational milestone; it does not settle questions about the breach, nor does one day of flows establish whether customers have regained confidence.

What happened when withdrawals reopened

Binance began the first phase at 06:00 UTC on Sunday, November 1. The company’s recovery notice listed 15 networks and associated assets, including Bitcoin, Ethereum, BNB Chain, Solana, XRP, Dogecoin, and several stablecoin routes. It said each network and asset pair would be restored only after readiness and security checks, with additional services to follow.

By 12:36 UTC, the full set in that initial phase was available, according to CNBC. Binance said service would return progressively and warned that traffic could cause temporary delays. Deposits, it said, had remained open during the withdrawal suspension.

The pause followed the October 29 compromise of Binance hot wallets. Binance’s October 30 incident update estimated the loss at about $6.3 billion in token assets. The FBI subsequently attributed the theft to TraderTraitor, a North Korean malicious cyber operation, and said investigators observed stolen assets being converted primarily into ether. The investigation and tracing work are ongoing.

Net outflows are not the same as wallet outflows

Binance’s $3.64 billion number is a net flow: withdrawals minus deposits over a stated period. It is not a count of customers, and it does not mean that every dollar left for another exchange. People may move assets to self-custody, another venue, or between accounts and wallets for operational reasons.

There is also a measurement distinction. Reuters reported that DefiLlama’s dashboard showed a larger movement in Binance-linked wallets, around $5.81 billion at one point. Such on-chain balance changes can include transfers between wallets controlled by the exchange and therefore are not identical to customer withdrawals. Binance disputed the earlier dashboard figure, saying it did not include transfers to its new hot wallet and that its own reported net flows were the closest measure of customer activity.

That is why the two totals should not be treated as competing measures of precisely the same thing. The exchange’s figure is based on its reported deposits and withdrawals during a defined window; wallet dashboards infer movement from addresses they track. Both offer signals, but their definitions and coverage differ.

Binance says most affected assets have been replenished

In its November 1 recovery update, Binance said it had covered approximately 95% of the stolen amount, up from 90% in its previous update. It said the remaining five percent consisted of less-liquid tokens that take longer to source at the required scale. Binance has said it will bear the financial impact rather than pass the loss to users.

The company also reported $171 billion in assets under management as of October 28. That is a dated company figure, not a real-time guarantee of solvency or proof that the incident’s technical cause has been fully resolved. Binance said it would publish a post-incident report after its investigation is complete. Its initial public updates described security checks and recovery measures, but did not provide a completed independent technical review.

The FBI’s attribution is separate from Binance’s recovery accounting. The agency named TraderTraitor and published wallet addresses for industry participants to monitor. That attribution does not by itself establish how every stolen asset moved or how much can ultimately be recovered.

What customers can and cannot infer

The first-day outflow is evidence that some customers used the restored access to move funds. It is not, by itself, evidence of a run. Reuters noted the $3.64 billion represented 2.1% of the reported asset base; a TRM Labs policy executive characterized the movement as consistent with a precautionary response rather than a wholesale flight. That is an attributed interpretation, not a definitive reading of every customer’s motive.

Nor does the exchange’s claim that it has replenished 95% amount to a public audit of every liability and asset. Binance pointed users to a proof-of-reserves snapshot, while its more detailed incident report remains pending. Readers should distinguish an exchange’s own recovery statement from independent verification of the full balance sheet and of the security controls that failed.

For anyone deciding what to do, the immediate practical question is whether a particular asset-network withdrawal route is currently available and processing normally. Binance’s notice advised customers to check its withdrawal page and network status page, and to expect delays during the phased rollout. Availability may vary by asset, chain, and region; the announcement did not promise that every service would reopen at once.

The next test is transparency, not just access

Restoring withdrawals reduced the immediate access problem, but it is only one step in recovery. The more consequential updates will be a completed account of how the hot-wallet compromise occurred, what safeguards changed, whether remaining assets are replenished, and what independent evidence supports the exchange’s reported reserves.

The outflow data will also need to be read over time. One day’s net movement captures the first response after a suspension, when pent-up requests and caution can both influence activity. Subsequent disclosures—with clear time windows and definitions—will make it easier to tell whether flows settle and whether the exchange’s operational assurances are matched by verifiable detail.

For now, the confirmed picture is narrow but material: withdrawals restarted in phases; Binance reported $3.64 billion in net outflows through 15:30 UTC; its own measure equaled 2.1% of its October 28 asset figure; and the exchange said it had replenished about 95% of affected assets. The technical investigation, remaining purchases, and longer-term customer response are still unresolved.