EL7.AI
CryptoMedium•3 November 2026•
4 min read

Binance Records Hourly Deposit Surplus, Keeps Net Outflows at $5.28 Billion

Key Facts

1Net outflows totaled $5.276 billion between November 1 and 3, about 3.1% of Binance's $171 billion in assets.
2Deposits exceeded withdrawals for the hour at 03:00 UTC on November 3.
3Binance said it had covered 95% of the affected amount, compared with 90% in its previous update.
4Binance estimated the incident's total impact at about $6.3 billion.

Binance said deposits exceeded withdrawals for the hour at 03:00 UTC on November 3, marking a shift to positive hourly flows, while cumulative net outflows since the attack remained at $5.28 billion. Exchange data for the period from 06:00 UTC on November 1 to 04:00 on November 3 showed it processed $10.97 billion in withdrawals and $5.695 billion in deposits. Net outflows during that period totaled $5.276 billion, equivalent to about 3.1% of the exchange's $171 billion in assets. The figures reflect continued net withdrawals during the phased reopening of services, even as deposits exceeded withdrawals in the latest hourly reading. Binance said, "Deposits were exceeding withdrawals every hour" at that time.

Binance announced on November 1 that it was resuming the first phase of withdrawals in stages, after readiness and security checks, within a window beginning between 06:00 and 09:00 UTC. In a subsequent update, the exchange announced it was reopening withdrawals for additional assets starting at 04:00 UTC on November 3, with the rollout continuing in stages. It said deposit services remained open and were unaffected by the incident. In its initial announcement, Binance said deposits were unaffected and continued to operate normally. The expansion of withdrawals comes as cumulative net flows remain negative, despite the reversal in hourly flow direction.

Binance estimated the incident's total impact at about $6.3 billion in its October 30 announcement. It said its initial investigation indicated that a DevOps engineer's laptop may have been compromised, then used to access a service container and send unauthorized withdrawal transactions. It added that about $3 billion of affected assets had been frozen on-chain by that update, and that it would cover the losses from its SAFU fund and company funds. The U.S. Federal Bureau of Investigation attributed the attack to North Korea, saying the theft occurred around October 29 and that the group involved is known as TraderTraitor. The Associated Press reported that Bitcoin fell 3.2% to below $79,000 on Thursday evening following the incident announcement.

In its November 1 update, Binance said it had covered about 95% of the affected amount, up from 90% in the previous update, while the remaining 5% consisted of less liquid tokens outside the top 10 assets. It said balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were covered in full at 100%. These percentages distinguish overall coverage of the affected amount from the exchange's statement that it had fully covered the balances of the 10 named assets. Binance founder Changpeng Zhao said only 6% to 10% of withdrawals went to competing centralized exchanges. He added that most of the funds moved to self-custody wallets that had not yet interacted with decentralized exchanges.

According to data shared by Chief Executive Richard Teng and reported by CoinDesk, customers withdrew $10.97 billion in cryptocurrency over 46 hours after the breach, with withdrawals exceeding deposits by a net $5.28 billion over the same period. Binance told Reuters on November 2 that it had recorded $2.7 billion in customer inflows since Sunday, while withdrawal volumes had stabilized after the initial surge. Reuters also compared the current net outflow with roughly $6 billion in withdrawals from Binance over 72 hours after FTX collapsed in 2022. The comparison shows that the positive hourly flow recorded by the exchange does not erase cumulative net outflows since the crisis began. Reuters reported that withdrawals had been frozen for more than two days after the breach, before customers were allowed to withdraw again on Sunday morning.

On November 2, Binance said the next proof-of-reserves snapshot would be conducted on November 4, covering a broader range than the previous 10 tokens. The exchange estimated that preparing the full zero-knowledge proof would take about 40 to 50 hours after the snapshot. It also said an incident report would be published once the investigation was complete. This comes as withdrawals continue to reopen for additional assets and networks following security and readiness checks. The expansion of withdrawals for the assets announced by Binance is scheduled to begin at 04:00 UTC on November 3.