Binance recorded approximately $3.64 billion in net cryptocurrency outflows on November 1, 2026, after restoring withdrawals following the $6.3 billion security breach that forced the exchange to suspend services three days earlier. The world’s largest cryptocurrency exchange processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC, according to figures released by the company.
The net outflow represented approximately 2.1% of Binance’s reported $171 billion in assets, based on its October 28 proof-of-reserves snapshot. Binance said withdrawal activity had declined following an initial surge, while deposits remained substantial. The figures provide an early indication of customer behavior following one of the largest cryptocurrency thefts on record, although the nine-and-a-half-hour reporting window does not establish whether withdrawals will continue at the same pace.
Withdrawals Resume Across 15 Blockchain Networks
Binance began restoring withdrawal services at 06:00 UTC on November 1, following security assessments and infrastructure checks conducted after the October 29 breach. By 12:36 UTC, withdrawals had resumed for all 15 networks included in the initial reopening phase. These included Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP Ledger, Tron, Arbitrum, Base and Optimism. Supported assets included BTC, ETH, USDT, USDC, BNB, SOL and XRP, among others. However, the reopening did not cover every cryptocurrency and network supported by Binance.
The exchange continued testing additional withdrawal routes, including those involving Cardano, Chainlink, Hyperliquid, Litecoin and NEAR. Binance warned that some transactions could experience delays as services returned and withdrawal demand increased. Independent blockchain analytics platform DefiLlama reported approximately $4.05 billion in Binance net outflows over the 24 hours ending around 11:14 a.m. Eastern Time on November 1. During the same period, competing exchange OKX recorded approximately $316.8 million in net inflows. The figures suggest that some customers were reallocating cryptocurrency holdings between trading platforms, although blockchain flows alone cannot establish individual motivations.
Asset Replenishment Reaches 95% Ahead of Reserve Report
The withdrawal restart follows Binance’s disclosure that attackers had stolen approximately $6.3 billion from exchange-controlled wallets on October 29. The incident prompted emergency asset freezes, investigations and a temporary suspension of withdrawals. On October 31, the FBI attributed the attack to North Korea’s TraderTraitor hacking operation. Binance said it had replenished approximately 95% of the affected assets using company resources, up from 90% in its previous update. The exchange reported that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances were fully backed.
The remaining 5% involved less-liquid tokens that Binance said would take longer to acquire through market and over-the-counter transactions. Asset replenishment is distinct from recovering stolen cryptocurrency, as Binance may replace missing holdings without retrieving the original funds. The company reiterated that customers would not bear the financial losses associated with the breach. Binance also confirmed that it had taken a new proof-of-reserves snapshot at 00:00 UTC on October 31. An updated report, incorporating zero-knowledge proof calculations, is expected on November 2.
The publication will provide additional information about the exchange’s reserve position following the attack and subsequent customer withdrawals. For now, the $3.64 billion outflow demonstrates substantial withdrawal demand but does not, by itself, establish a liquidity shortfall. The next indicators will be the updated reserve figures, completion of withdrawal restoration and whether customer outflows continue after the initial reopening period.
