Binance Sees $3.64B Leave as Withdrawals Resume After Hack

Binance says customers moved a net $3.64 billion off its exchange in the first nine and a half hours after it began restoring withdrawals on Sunday, 1 November. The figure turns the exchange’s reopening into a concrete test of customer confidence after the estimated $6.3 billion security breach. It is not an additional amount stolen by the attackers.

According to figures shared by Binance, users withdrew about $4.65 billion and deposited about $1.01 billion between 06:00 and 15:30 UTC. Subtracting deposits leaves the $3.64 billion net outflow. Binance put that at 2.1% of the $171 billion in assets it reported in its earlier proof-of-reserves data. The company said withdrawals spiked at first and then began to stabilise.

Other numbers circulating online measure different periods and sometimes different sets of wallets. The Block reported that DefiLlama showed about $4.05 billion leaving Binance over a rolling 24-hour window at 11:37 a.m. Eastern Time on Sunday. A later Reuters report put the tracker figure at about $5.81 billion at another point. These readings are not a direct contradiction of Binance’s first 9.5-hour calculation, and none should be treated as a fixed final total.

DefiLlama’s live exchange dashboard changes as its 24-hour window moves. It also tracks wallets it has identified, rather than reproducing Binance’s internal account records. The apparent gap matters, but a proper comparison requires the same start and end times, assets and accounting method. Adding the estimates together would double-count activity.

A withdrawal can be a customer transferring funds to a private wallet, moving to another exchange or simply reducing exposure while the service recovers. The public figures do not reveal each customer’s motive. Nor does a large flow by itself establish that Binance is insolvent. The more revealing question is whether legitimate withdrawals continue to clear and whether the exchange can verify the assets backing remaining balances.

Binance suspended deposits and withdrawals after the 29 October attack and then reopened withdrawal routes in phases. At the time of the first outflow report, not every coin and network was fully restored. Users therefore need to check the exchange’s current status for the asset and network they intend to use rather than assume one reopening notice covers everything.

TechBooky previously reported Binance’s claim that 90% of affected assets had been replenished. That was a statement about replacing assets affected by the theft, not a measure of the later customer withdrawals. Both issues are important, but they answer different questions. Replenishing a stolen token does not prevent a customer from deciding to move a legitimate balance elsewhere.

The exchange has said it will publish an updated proof-of-reserves report based on a post-attack snapshot. That report, together with the pace of withdrawal restoration and a fuller account of the breach, will give users a better basis for judging its recovery than one dramatic outflow number. For now, $3.64 billion is Binance’s defined early-window net figure, while independent rolling estimates have continued to move.