Binance withdrawals reopened on Sunday, 1 November, three days after a hack that took about $6.3 billion from its wallets. Customers pulled out a net $3.64 billion in the first nine and a half hours, about 2.1% of the exchange’s assets, according to figures Binance posted and CNBC reported.
Binance withdrawals came back in phases. Phase one ran from 06:00 to 09:00 UTC and covered bitcoin, ether, USDT, USDC, BNB and XRP, among 15 networks and assets in all. CNBC reported that all 15 were back by 12:36 UTC, with testing continuing on the rest. CoinDesk quoted the exchange calling its plan “a controlled approach.” Delays were possible, Binance said.
Binance withdrawals on day one
Binance withdrawals on day one ran from 06:00 to 15:30 UTC on 1 November. In that window Binance said it processed $4.65 billion in withdrawals and $1.01 billion in deposits. The gap is the $3.64 billion net outflow. CNBC measured it against $171 billion in total assets, taken from Binance’s proof-of-reserves data as of 28 October, which gives the 2.1%.
Founder Changpeng Zhao wrote on X that “98% choose to stay!” He added that most of the net outflow happened in the first couple of hours after the restart, and Binance said withdrawal volumes were falling back after an early spike. Both statements come from Binance’s side, and the exchange has not published an hourly breakdown.
Who pays, and how much of the stolen money is frozen?
Binance says it does. A spokesperson said the exchange “will bear the financial impact of the stolen funds”, and co-CEO Richard Teng had told customers on 30 October that their money was safe and every loss would be covered. On that day Binance said it had set aside more than $6.34 billion of its own funds, with about $5 billion already held in the same tokens that were taken.
By the weekend Binance said it had replaced about 95% of the affected assets, up from 90% a day earlier. The remaining 5% is tokens outside the top ten by size, which trade thinly and take longer to buy, so Binance withdrawals reopened while that last slice was still being bought. Binance said balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are “fully backed 100%”. That is Binance’s own claim until the proof-of-reserves report it has promised is published.
Binance says about $3 billion is frozen, most of it USDT and USDC, which Tether and Circle can block. Circle froze more than $1.1 billion in USDC with law enforcement, CNBC reported. On Friday its chief executive, Jeremy Allaire, had put the figure above $800 million. Bitcoin and ether can’t be frozen, because no company issues them. TRM’s count on 30 October had the attacker holding more than 420,000 ETH and 18,270 BTC, roughly $2.4 billion beyond anyone’s reach.
The FBI attributed the attack to a North Korean group known as TraderTraitor on Saturday, 31 October, and said the group was converting the assets mainly into Ether. TRM had named the same group with high confidence earlier. Teng said the company’s own investigation hasn’t pinned the attack on any one person.
Open questions and next steps
How the attackers got in. Reopening Binance withdrawals did not answer that. Binance’s first account pointed to a compromised engineer’s laptop, and a later update said further work had uncovered additional points of breach. TRM’s reading of the on-chain trail is a break-in at the system that signs Binance’s withdrawals. Binance has not published a root cause. It has said a detailed incident report will follow once the investigation ends, with no date.
The other open item is the proof-of-reserves report. Binance has promised a full one, and an updated version once repairs finish. Until it appears, the claim that every balance is fully backed rests on the exchange’s word.
Later phases of Binance withdrawals depend on each network passing Binance’s security and stability checks, and the exchange has given no schedule for them. Anyone with funds on Binance can already withdraw the major assets, but delays are possible, and a customer who needs a thinly traded token may find it still closed.
Figures here come from public reporting by Binance, CNBC, CoinDesk, TechCrunch and TRM Labs up to 4 November 2026. Binance may revise them when its reports come out.
