Binance customers withdrew $4.65 billion and deposited $1.01 billion in the first nine and a half hours after the exchange reopened withdrawals, leaving net outflows of $3.64 billion. That equals 2.1% of the $171 billion in assets the exchange reported holding on 28 October, according to Reuters.
It is the first hard measure of what customers did once the doors opened. It is also disputed. DefiLlama’s dashboard put the same day’s net outflow at $5.81 billion, and Binance has told Reuters that reading is not accurate.
Customers Pulled $3.64 Billion in the First Nine and a Half Hours
The window ran from 1 a.m. to 10:30 a.m. ET on Sunday 1 November, the first stretch of trading after a suspension that the exchange had signaled would last about 48 hours. Binance said withdrawals were stabilizing after an initial spike and that deposit volumes remained “substantial.”
Founder Changpeng Zhao read the same data as a vote of confidence, posting on X that most of the net outflow arrived within the first couple of hours.
12 hours after withdrawals resumed: 2.1% net outflow, with most occurring in the first couple of hours. Over $1 billion in flow, too.
98% choose to stay!
Trust isn’t earned by what you say in good times. It’s earned by what you do in hard times.
Thank you for your trust! 🙏🙏🙏🙏
— CZ 🔶 BNB (@cz_binance) November 1, 2026
The restart ran in phases, the first covering 15 tokens including bitcoin, ether, dogecoin and some USDC and USDT pairs. “We are taking a phased approach by prioritizing tokens based on the past week data of user demand,” the exchange said in a post on X, adding, “Rest assured that market conditions are stable.”
Bitcoin traded above $78,000 on Monday after a six-week low on Friday. Ether recovered to $2,287 following a two-month low. Binance has 335 million registered users.
Binance Says DefiLlama’s Bigger Number Is Missing Its New Hot Wallet
The tracker and the exchange do not agree, and the gap is $2.17 billion. DefiLlama raised its own reading during the day, from $4.36 billion to $5.81 billion. Binance disputed the earlier figure and gave a mechanical reason for the difference.
“This figure does not contain the flows we have deposited to our own new hot wallet, so they are not accurate. Our last update on X is closest to accurate (outstanding the moves in both deposits and withdrawals since it was posted).”
The windows are not the same either, because the exchange counted 9.5 hours against DefiLlama’s 24. And it has not addressed the revised $5.81 billion number, only the first one. Reuters said Binance did not immediately respond to a request for comment on the updated figures.
The exchange and the tracker are $2.17 billion apart on the same day, and they are not measuring the same window. Source: Binance via Reuters, DefiLlama · Chart: FinanceFeedsInvestor Takeaway
Binance’s $3.64 billion covers 9.5 hours and counts deposits into its own new hot wallet. DefiLlama’s $5.81 billion covers 24 hours and, by the exchange’s account, does not.
Coverage Reached 95% and the Last 5% Is the Hard Part
Binance said it has covered $6 billion of the stolen tokens by spending its own money on replacements, taking coverage to 95% from the 90% it reported on Saturday. The remaining 5% consists of less liquid assets that may take longer to source.
The updated proof-of-reserves report has slipped to Tuesday 3 November, moved in the exchange’s third recovery update from an earlier commitment to Monday. The snapshot it rests on was taken on 31 October.
“A hack at a financial institution means stolen usernames and passwords. A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people’s capital,” said Ari Redbord, global head of policy at TRM Labs.
Spot bitcoin ETFs shed $643 million on Friday, the largest daily outflow of October, according to Redbord, who also counted more than $1.3 billion of leveraged positions liquidated. The combined market value of USDT and USDC has fallen by about $1.2 billion since Friday, per CoinMarketCap data cited by Reuters.
Daily flows ran inside a $2 billion band for five months before the final two sessions. Source: DefiLlamaThe Attacker Kept Moving Money While the Doors Were Open
The FBI said on Saturday that the North Korean unit TraderTraitor was responsible, and that law enforcement watched members convert stolen assets into ether. President Donald Trump said later the same day that it remained unclear whether North Korea was involved, telling reporters that “if it is, we’ll talk to North Korea about it.”
Onchain analyst SomaXBT, a Security Alliance contributor, counted $242 million moved across Tron over two days of the weekend, with about $194 million leaving through bridges and swap services. The attacker had roughly $249 million left to move after Tether froze 378.7 million USDT, and had already dumped $158 million of altcoins in the days before.
The theft lands in a year that has produced 322 recorded incidents and $8.73 billion of losses. It also tests the infrastructure built to contain exactly this, from issuer freezes to the federally regulated stablecoins now carrying compliance obligations of their own.
Investor Takeaway
Coverage at 95% leaves about $315 million of less liquid tokens unsourced, and Tuesday’s proof-of-reserves report is the first independent check on the rest.