Binance Sees $3.64 Billion in Net Outflows as Withdrawals Reopen

Binance recorded approximately $3.64 billion in net outflows in the first nine and a half hours after restoring withdrawals on Sunday, the exchange said, the first sustained test of customer confidence since Thursday's $6.3 billion hack — the largest cryptocurrency theft on record.

The exchange processed $4.65 billion in withdrawals and $1.01 billion in deposits between 1 a.m. and 10:30 a.m. ET, according to a statement Binance posted on X. The company framed the net outflow as 2.1% of the $171 billion in assets it reported under management in its latest proof-of-reserves data, dated Oct. 28.

Put differently: for every dollar that left the platform in the reopening window, roughly 22 cents came back in.

What does the reopening actually cover?

Binance began restoring withdrawals in phases at 1 a.m. ET and completed the first phase — all 15 networks and assets included in it — by 7:36 a.m. ET. The scope remains narrow. As of 11:22 a.m. ET, the exchange's status page showed withdrawals suspended for 531 of the 552 listed coins, with 14 others, including bitcoin and ether, only partly restored.

The remaining networks and assets still under testing include Cardano, Chainlink, Hyperliquid, Litecoin and NEAR. No timeline has been published for that second wave.

Withdrawal volumes spiked at the reopening and have since declined, a pattern Binance described as "stabilising as expected." Deposit volumes, the exchange added, "have remained substantial."

How do independent numbers compare?

Third-party tracking broadly corroborates the exchange's account. DefiLlama data showed $4.05 billion in net outflows from Binance over the 24 hours to 11:14 a.m. ET, measured across the $131.1 billion in assets the platform tracks in the exchange's wallets. The figure sits close to Binance's own tally, suggesting the outflow picture is not materially worse than disclosed.

The competitive context is notable. Rival exchange OKX recorded $316.8 million in net inflows over the same 24-hour period, per DefiLlama — an early indication that at least part of the departing liquidity is rotating to other venues rather than exiting the market entirely.

Attribution and solvency posture

The outflows follow Thursday's breach, in which attackers drained roughly $6.3 billion from Binance's hot wallets, forcing a temporary withdrawal suspension. On Saturday, the FBI attributed the theft to North Korea's TraderTraitor hacking group.

Binance has moved quickly to signal solvency. On Friday, the exchange said it had readied $6.34 billion to cover hack losses. On Saturday, co-CEO Richard Teng said the exchange had already replenished 90% of the stolen assets and would cover the remainder.

Operationally, Binance now processes withdrawals from newly generated wallets added to its proof-of-reserves list — a reconstruction of the withdrawal infrastructure after the compromise of the prior hot-wallet setup.

What changes for practitioners?

The pivotal disclosure arrives Monday. Binance said an updated proof-of-reserves report — based on an Oct. 31 snapshot and computed with zero-knowledge proofs — is projected for release then. That report is the first independently verifiable balance sheet the exchange will publish since the breach, and it is the document against which the company's $171 billion asset figure and its claim to have absorbed the loss can be checked.

Until it lands, two practical constraints remain: withdrawals are live for only a fraction of listed assets, and the FBI's attribution to a state-linked actor means recovery of stolen funds is unlikely.

The Monday report, and the pace of the remaining network reopenings, will determine whether the $3.64 billion outflow was the bulk of the exit or merely its first tranche.