EL7.AI
CryptoMedium•1 November 2026•
4 min read

$3.64 billion net outflows from Binance within hours of withdrawal resumption

Key Facts

1Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits, for net outflows of about $3.64 billion during the first nine and a half hours after withdrawals resumed on November 1.
2The net outflow was equivalent to 2.1% of Binance’s $171 billion in assets, according to proof-of-reserves data dated October 28.
3Binance resumed withdrawals in stages at 06:00 UTC on November 1 and had made the service available by 12:36 across the 15 networks in the first phase.
4Binance said it had covered about 95% of the affected amount in its November 1 update, up from 90% in the previous update.

Binance recorded net outflows of about $3.64 billion during the first nine and a half hours after it resumed withdrawals on Sunday, November 1, having processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC. The platform said the net outflow was equivalent to 2.1% of its $171 billion in assets, based on its latest proof-of-reserves data dated October 28. The movement came after a temporary suspension of withdrawals following a security incident, with service then restored in stages. The scale of withdrawals represents an early test of customer confidence in the platform after the attack, according to Reuters. Binance said deposits remained substantial during the same period.

Binance began restoring withdrawals at 06:00 UTC on November 1 and said it had made the service available by 12:36 across all networks and assets in the first phase, covering 15 networks. The list included Bitcoin, Ethereum, BSC, TRX, Solana, XRP, ZEC, DOGE, TON, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism and Sui. The company said the rollout was taking place in stages, with priorities set based on user-demand data from the previous week. It added that it was testing the remaining networks and assets and would announce the next phase when they were ready. It warned that some transactions could be delayed or take longer to process during the initial rollout because of heavy traffic.

Binance said withdrawal volumes initially rose, then fell and began to stabilize, while deposits remained substantial. Reuters quoted the platform as saying withdrawal levels were returning to normal, expected on-chain activity. In a separate comparison, DefiLlama said Binance’s net outflows exceeded $3.5 billion on Sunday; Reuters added that Binance did not comment on DefiLlama’s data. The $3.64 billion figure, meanwhile, appeared in Binance’s update on withdrawals and deposits it processed during the first nine and a half hours after service resumed. In another statement, the platform described market conditions as stable, without linking this to any specific price movement.

Binance said the incident’s total impact was estimated at about $6.3 billion and that it had worked with blockchain partners to freeze about $3 billion in affected assets on-chain as of its October 30 update. In an update on November 1, it said it had covered about 95% of the affected amount, compared with 90% in its previous update, and that the remaining 5% involved tokens outside the top 10 listed assets. It added that those tokens were less liquid and could take longer to buy in the required quantities. Binance told Reuters it had internally allocated about $6.34 billion of company funds to cover losses. It said purchases of alternative tokens also drew on the SAFU fund, the futures insurance fund and the company treasury.

Binance said the withdrawal suspension was a precautionary measure to contain the incident’s losses, assess its impact, restore affected services and complete security checks. It said deposit services remained open and were unaffected, distinguishing the temporary withdrawal suspension from a freeze on users’ assets. The company said preliminary investigation findings indicated that a DevOps engineer’s laptop may have been compromised, allowing the attacker to access a service container and submit unauthorized withdrawal transactions. It added that it had found no evidence that private wallet keys had been leaked. The U.S. Federal Bureau of Investigation attributed the attack to the TraderTraitor group and said the same group was behind the $1.5 billion Bybit hack the previous year.

Next steps include updating proof-of-reserves data and publishing details of the investigation. Binance said it took a new proof-of-reserves snapshot at 00:00 UTC on October 31, with the updated report expected on its website on Monday, November 2. It also estimated that generating the full zero-knowledge proof would take about 40 to 50 hours, and expected to make it available by Tuesday, November 3, UTC. The company said a post-incident report would be published after the investigation was complete. It had said withdrawal restoration would continue in stages, with users updated on the assets and networks included in subsequent phases.