Binance Saw $3.64bn of Net Outflows on Its First Day Back

Binance reopened cryptocurrency withdrawals in phases on 1 November 2026 and customers took out $3.64 billion more than they put in over the next nine and a half hours. The exchange, the largest in the world by volume, said in a post on X that the net figure covered 0600 to 1530 GMT and amounted to 2.1 per cent of its $171 billion of assets under management, Reuters reported. Withdrawals had been frozen for more than two days after attackers drained about $6.3 billion from hot wallets on 29 October, the largest cryptocurrency theft on record.

The restart was staged. Reuters reported that the first phase began between 0600 and 0900 GMT, with the bitcoin network going live first, and CNN reported that 15 digital currencies, among them bitcoin, ether and Solana, had been restored by 7:36 a.m. US Eastern time, with further assets and networks to follow as security checks completed. Deposits had been working again for several days before that.

Replaced, not recovered

The 95 per cent coverage figure Binance published on 1 November is a statement about replacement rather than recovery. The exchange said on 31 October that it had reached 90 per cent, up from 80 per cent the day before, by spending its own money to buy new tokens: part of the roughly $1 billion Secure Asset Fund for Users, a bitcoin reserve it keeps for breaches, part of its futures insurance fund, and corporate treasury cash. In total it set aside about $6.34 billion internally. The remaining tokens are the least liquid, which Binance says is why they take longer to source in the required amounts.

On 31 October it also took a fresh proof-of-reserves snapshot, timed at 0000 GMT, covering ten tokens including bitcoin, ether, tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD and Zcash, so that holders could verify backing of at least one to one. Separately, cryptocurrency firms working with the exchange froze about $3 billion of the stolen assets on-chain, according to CNN.

A laptop, and a gap in the public account

Teng said on 30 October that the breach was a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its own activity, which he said made tracing and investigating harder. Binance's earlier account pointed to a compromised engineer's machine as the entry point. What has not been set out publicly is how access to one endpoint became authority to move assets across ten blockchains, and that is the question other custodians need answered rather than the headline number.

The shape of it is the pattern of the autumn. Stolen GitHub tokens put a poisoned LiteLLM build on PyPI and Docker for under three hours in October, as Parallax Nexus reported on 26 October, with the attackers spending harvested cloud credentials hours later. In both cases the signing or release path, not the perimeter, was the thing that failed.

The FBI has attributed the theft to North Korea, Reuters reported, and the blockchain analytics firms TRM Labs and Chainalysis have pointed to the state-linked group known as TraderTraitor. At about $6.3 billion the haul is roughly four times the previous record, the $1.5 billion taken from Bybit in February 2025. The judgment that matters for users is narrower than the attribution: Binance has put its own balance sheet between the theft and its customers and the first day of withdrawals did not break it, with a spokesperson telling Reuters that volumes spiked and then showed "a sharp downward trend". Whether that holds depends on a mechanism the exchange has not yet described.