Binance Withdrawals Resume After $6.3B Hack: $3.64B Outflow Explained
Binance has reopened withdrawals for specified cryptocurrencies across its first 15 networks, including BTC on Bitcoin and selected USDT and USDC routes. Between 06:00 and 15:30 UTC on November 1, customers withdrew $4.649 billion and deposited $1.01 billion, a net outflow of about $3.64 billion. Later blockchain-tracker figures were higher, but different time windows cannot prove customers are permanently abandoning the exchange.
Published reporting frame: November 2, 2026. Research and verification cutoff: November 2, 2026, 10:14 UTC. Scope: Binance.com; regional platforms, payment rails and account-specific availability may differ. Figures and statuses are point-in-time reports, not live guarantees.
Which Binance withdrawals are working again?
The important change since Cryptolinks’ October 30 Binance breach report is that withdrawal access has actually begun returning. In its November 1 recovery notice, Binance announced a planned 06:00–09:00 UTC first-phase start. In a subsequent company update, it said restoration started at 06:00 UTC and all 15 networks in that first phase were enabled by 12:36 UTC. That later statement is stronger evidence of activation than the scheduled window alone.
| Service or route | Latest verified reported status | Effective time | Source |
|---|---|---|---|
| BTC on Bitcoin network | Enabled in phase one, according to Binance; not a guarantee for every account | By Nov. 1, 12:36 UTC | Binance completion update |
| USDT on Ethereum (ERC-20), BNB Smart Chain, Tron and Solana | Listed in phase one; Binance says its first-phase routes were enabled | By Nov. 1, 12:36 UTC | Routes notice and completion update |
| USDC on Ethereum, BNB Smart Chain, Solana and Base | Listed in phase one; Binance says its first-phase routes were enabled | By Nov. 1, 12:36 UTC | Routes notice and completion update |
| ETH on Ethereum; BNB on BNB Smart Chain; SOL on Solana; XRP on XRP Ledger | First-phase routes enabled, per Binance | By Nov. 1, 12:36 UTC | Binance routes notice |
| Further cryptocurrencies and networks | Not confirmed as generally restored; Binance says it was testing remaining routes | Still outstanding in Nov. 1 completion statement | Binance update |
| Crypto deposits | Binance says deposits remained open | Nov. 1, 04:08 announcement | Binance recovery notice |
| USD cash withdrawals (fiat) | Reuters reports the US dollar cash withdrawal option returned Monday; a Binance notice specifying the payment rail, region and eligible customers was not verified | Nov. 2; exact activation time unconfirmed | Reuters, accessible syndication |
The phase-one list also includes DOGE, ZEC, SUI, and specified routes on TON, Polygon, Avalanche C-Chain, Arbitrum and Optimism. It is an asset-and-network list, not a platform-wide all-clear. Earlier on November 1, The Block reported that hundreds of other listed coins still had withdrawal restrictions; that was a historical status-page reading, not a verified current count.
For any transfer, I would check the precise coin and selected network on Binance’s official network status page or my authenticated withdrawal screen. A USDT blockchain withdrawal is not a USD bank transfer. Reuters’ USD report does not establish that ACH, SWIFT, SEPA, cards or any other rail is available to every customer, or that the same service works for deposits. I would ignore anyone offering paid unlocking, recovery agents or a special address to release funds.
How much actually left Binance? The $3.64B, $5.8B and $7B figures
The cleanest calculation comes from Binance’s own defined reopening window. The exchange’s November 1 company statement gives $4.649 billion in withdrawals minus $1.01 billion in deposits = $3.639 billion net out, rounded to $3.64 billion. That measurement covers 06:00–15:30 UTC on November 1, exactly 9½ hours. It covers the company’s reported platform activity; its public summary does not provide a transaction-by-transaction reconciliation of products, internal movements or fiat components.
| Reported measurement | Time window or observation | Net outflow | What it tells us |
|---|---|---|---|
| Binance: gross withdrawals $4.649B less deposits $1.01B | Nov. 1, 06:00–15:30 UTC; 9½ hours | $3.639B (about $3.64B) | Company-reported net activity after reopening; original company account |
| DefiLlama, reported by The Block | Rolling 24 hours, read Nov. 1 at 11:37 a.m. U.S. Eastern time | About $4.05B net out | A separate tracked-wallet snapshot; dated report |
| DefiLlama, reported by Cointelegraph | Rolling preceding 24 hours in its Nov. 1 report; exact UTC snapshot not supplied | About $5.8B net out | Another later-preserved tracker observation; dated report |
| DefiLlama, reported by Cointelegraph | Later Nov. 2 rolling 24-hour observation; exact UTC snapshot not supplied | More than $7B net out | An updated, moving-window tracker reading; dated report |
These are not four amounts to add together, and $3.64 billion to $7 billion is not a confidence interval for a single underlying total. The exchange’s platform statement and the tracker are measuring different populations and periods. The tracker observes labeled on-chain wallets rather than a verified register of unique customers or bank withdrawals. Its exact historical wallet coverage, treatment of relabeling, transfers between company wallets and replenishment flows were not established for the cited snapshots. Asset prices can also change the dollar value of reserves without any coin moving.
Binance calculated the 2.1% figure by comparing its $3.64 billion net outflow with roughly $171 billion of assets it reported as of October 28: $3.639B divided by $171B is about 2.13%. That is a useful scale comparison, but it is not the percentage of customers who left. The DefiLlama exchange dashboard tracks a narrower wallet asset base, so its dollar-denominated reserve total should not be substituted for Binance’s $171 billion denominator.
Here is how “billions withdrawn” and “withdrawals are stabilizing” can both be true: customers may withdraw very large amounts when a pause ends, creating a sharp opening spike. Even if withdrawals per hour then decline, the cumulative money already withdrawn still grows. Binance said its initial spike eased; the publicly verified snapshot does not by itself give me a complete, independently comparable hourly series. Nor can I subtract a rolling 24-hour snapshot from the company’s 9½-hour figure and label the difference the next 14½ hours.
One particularly misleading coincidence is the $5.8 billion figure. The later DefiLlama figure represents reported post-reopening, tracked-wallet net exchange flows. Earlier forensic reports also used figures in roughly that range for unauthorized transfers during the October 29 theft. Those are separate events. The hacked assets cannot be counted again as voluntary withdrawals, and the figures must never be totaled as if they are two losses of the same kind.
Do larger outflows mean Binance customers are leaving for good?
I see three explanations that can operate at the same time. First, withdrawals that customers wanted to make during the suspension would have queued up for the reopening. Second, some account holders may have reduced their exposure to Binance after a serious security failure. Third, others may have moved assets to different exchanges or private wallets while remaining invested in cryptocurrency.
There is some evidence of movement elsewhere in the sector, but not enough to identify everyone’s motive. Cointelegraph’s November 2 comparison, drawing on DefiLlama, reported roughly $445 million in 24-hour net inflows at OKX, $112 million at Bybit and $91 million at Gate. That does not prove those deposits originated at Binance, and DefiLlama does not cover every exchange equally. A receiving wallet without a reliable label is not evidence of self-custody; a transfer to an exchange is not evidence of selling crypto.
The missing tests matter. I have not established a clean pre-hack, like-for-like hourly withdrawal baseline across exactly the same routes, nor several completed post-reopening days of comparable net flows. Withdrawals themselves tell us money moved; they do not reveal how many unique customers closed accounts or what those customers intend to do next.
My assessment: the first hours show a real test of withdrawal access and a substantial demand for it, not a demonstrated permanent loss of the customer base. I would put more weight on whether net withdrawals remain unusually high after queued requests clear and more routes reopen. I would also want matching customer balances, independently assessed reserves and a reliable cross-exchange comparison before calling this a lasting shift in trust.
Stolen, frozen, recovered and replenished: four different balances
The backdrop is the October 29 security incident, when Binance says unauthorized withdrawals began at around 20:05 UTC from its hot wallets. Its October 30 disclosures place the impact at approximately $6.3 billion. Elliptic’s investigation values the theft at about $6.43 billion, reflecting its tracing and valuation methodology; the firm describes it as the largest single crypto theft relative to previous recorded incidents, including the $1.46 billion Bybit theft in 2025.
Stolen means assets moved without authorization. Frozen means movement has been restricted; Binance said about $3 billion was frozen with partners in its initial report. Recovered should mean assets actually returned to verified control or otherwise restored through a documented process. Replenished means Binance sourced replacement tokens or allocated company resources so customer balances could be backed despite the theft. I would not use these terms interchangeably.
The progression is concrete. In its October 30 update, Binance said it had set aside more than $6.34 billion and held about $5 billion of the specific affected token types, describing approximately 80% coverage at that point. The October 31 notice raised that figure to 90%. The November 1 notice then said approximately 95% of the impacted amount had been replenished with the relevant token assets, while the remaining 5% were less-liquid assets it was still purchasing. Binance describes using its corporate treasury, part of SAFU and a portion of its futures insurance fund.
Binance separately asserted that its BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances were each 100% backed. It said a new Proof of Reserves snapshot was taken at 00:00 UTC on October 31. The October 31 notice said the full zero-knowledge proof could take 40–50 hours and estimated readiness by November 3; a later update expected an updated report on November 2. I could verify the company’s snapshot announcement and PoR explanation, not an independent audit of all liabilities or a completed post-hack proof verification. A token-by-token backing claim is narrower than an independent assessment of liquidity, solvency and all obligations.
The frozen money is not automatically the same money Binance has bought to replace the loss. For example, a stablecoin issuer’s freeze may immobilize attacker-held balances without reversing the theft or putting funds back in Binance’s wallets. Reuters reported on November 2 that Circle said it had frozen more than $1.1 billion in stolen USDC. That is an issuer-reported frozen amount, not proof of a completed cash or token recovery.
What investigators know about the attack now
Binance’s initial account was carefully qualified: its investigation suggested a potentially compromised DevOps engineer laptop gave the attackers access to a service container from which unauthorized withdrawals were submitted. It said it had found no evidence of a wallet private-key leak. A subsequent company update said investigators had identified additional points of compromise, so a single-laptop account should not be treated as a final technical explanation. Binance has promised a fuller post-mortem, but I could not verify its publication by the reporting cutoff. Source: Binance incident updates.
Attribution has moved beyond early private-sector suspicion. On October 31, the FBI issued a notice specifically identifying North Korea’s TraderTraitor activity as responsible for the Binance theft. The FBI said its investigators and partner agencies observed actors converting stolen assets primarily into ETH and published attacker-associated addresses for financial services to screen. That is an incident-specific official statement, not an attribution borrowed from the earlier Bybit case. Transfers between flagged addresses do not increase the original stolen total. They may help with tracing, but they do not show that money has been returned.
Bitcoin and ETFs tell different parts of the story
Bitcoin was trading around $78,370 on Kraken at approximately 04:50 UTC on November 2, according to a timestamped market report, after a volatile post-hack week. That quote is a time-specific price, not proof that volatility has ended or that the reopening caused a recovery.
On a separate clock, Farside Investors’ completed-session data show $643.2 million in net outflows from tracked U.S. spot Bitcoin ETFs on Friday, October 30, following $17.2 million in net inflows on Thursday, October 29. Friday was the first full U.S. ETF session after the late-Thursday disclosure; the funds were not trading when Sunday crypto withdrawals reopened. Those are ETF fund flows—not Binance customer withdrawals—and cannot be added to Binance’s net outflow or assigned one cause from timing alone.
What would change my view?
I would look for three developments before making a stronger judgment. The first is a complete, route-by-route reopening and multiple days of withdrawals and deposits measured on comparable terms, ideally against normal pre-incident levels. The second is credible verification of customer-asset backing, liquidity and the status of harder-to-source tokens. The third is a technical post-mortem explaining how unauthorized withdrawal instructions were authorized and how Binance has changed its controls.
In the meantime, I would separate a working withdrawal path from a broad statement about platform safety. For more reporting, I follow the Cryptolinks news section and its exchange-security coverage. If you are evaluating exchange custody, Cryptolinks maintains guides to crypto exchanges, non-custodial wallets, blockchain explorers and on-chain analytics tools. For ETF background, the Cryptolinks Bitcoin ETF directory explains the available research resources. Those guides—and the Cryptolinks homepage—are starting points for understanding options and evidence, not guarantees about any individual service.
My conclusion is measured: access has genuinely returned for the announced first phase, and billions in net withdrawals are documented. But neither the company-reported early slowdown nor the larger rolling tracker snapshots tell us yet how many customers are leaving permanently. The test is what happens after ordinary withdrawal access—and ordinary behavior—return.
Binance withdrawal FAQ
Are Binance BTC withdrawals working?
Binance says BTC withdrawals on the Bitcoin network were enabled as part of phase one by 12:36 UTC on November 1. Check the live status for your specific asset and account, because later pauses or individual limits are possible.
Can I withdraw USDT or USDC?
Binance’s first phase included USDT on Ethereum, BNB Smart Chain, Tron and Solana, among other routes, and USDC on Ethereum, BNB Smart Chain, Solana and Base, among others. You need to match the withdrawal network to the receiving network. Availability of one route does not establish availability of every route.
Can I withdraw US dollars to my bank?
Reuters reported the return of a USD cash withdrawal option on November 2. I could not verify the eligible jurisdiction, banking rail, or account-level conditions from an official incident notice. This is a reported fiat withdrawal option, not a guarantee that all bank payments work.
Did $7 billion leave after the $3.64 billion?
Not as a separate additive amount. $3.64 billion is Binance’s reported net outflow during a fixed 9½-hour window; the more-than-$7-billion figure is a later rolling 24-hour tracked-wallet net outflow. The windows overlap and the sources do not measure the same thing.
Has Binance recovered 95% of the stolen crypto?
No such recovery percentage was verified. Binance said it had replenished roughly 95% of the impacted amount in affected token assets by November 1 using its resources. Assets frozen in attacker-associated wallets and assets actually returned to Binance are separate categories.
Is Binance safe now?
Binance says it will absorb the theft and has resumed named withdrawal routes. That is meaningful progress, but it is not an independent certification of all operational controls, financial resources or future safety. I would evaluate the next reserve proof, recovery disclosures, full withdrawal restoration and forensic report before making a broader claim.
