Binance users withdrew a net $3.64 billion shortly after the exchange resumed withdrawals on November 1, following a major security breach earlier in the week. The outflow represented only 2.1% of Binance’s total assets, which amounted to approximately $171 billion before the incident, according to company data.
Withdrawals surge then stabilize after reopening
Withdrawals were restored in phases beginning at 06:00 UTC on November 1. Within the first hours, all 15 networks and assets included in the initial phase became operational by 12:36 UTC, as indicated by Binance’s update on social media.
Between 06:00 and 15:30 UTC, users pulled out $4.649 billion, while deposits during the same period reached $1.01 billion, resulting in the net outflow of $3.64 billion. Binance based the 2.1% figure on its Proof of Reserves data taken on October 28, demonstrating the platform’s available user assets at the time.
The spike in withdrawals eased after the first few hours and eventually stabilized, with continued significant deposit activity.
| Timeframe | Total Withdrawals | Total Deposits | Net Outflow | Percentage of Assets |
|---|---|---|---|---|
| Nov. 1, 06:00–15:30 UTC | $4.649 billion | $1.01 billion | $3.64 billion | 2.1% |
Binance founder Changpeng Zhao stated that most of the net outflow occurred within the first two hours after withdrawals resumed. He highlighted that “98% choose to stay!”
Most of the net outflow happened in the first couple of hours after withdrawals resumed, with Binance maintaining that “98% choose to stay!”
Binance is conducting another Proof of Reserves snapshot and has initiated a zero-knowledge proof process to confirm asset holdings. The company planned to publish the updated reserves data on its website. According to Binance, market conditions have remained stable since withdrawals resumed.
Tim Sun, a senior researcher at HashKey Group, said the event had not triggered “widespread panic or a massive, concentrated withdrawal.” Analysts noted that the incident may temporarily discourage institutional crypto buying.
Binance is the world’s largest cryptocurrency exchange by trading volume, known for supporting a wide range of digital assets and offering various financial products for users globally.
Mini dictionary: Proof of Reserves is an independently verified audit showing an exchange holds enough crypto assets to fully cover user balances, aimed at improving transparency and user trust.
Investigation and response to historic hack
Withdrawals recommenced following a security breach on October 29, when hackers managed to steal approximately $6.3 billion. Security firm Blockaid reported that the breach originated from a compromised laptop belonging to a DevOps engineer, which provided access to an internal service container and enabled unauthorized withdrawals.
The hacker targeted Binance 14, a major Ethereum hot wallet, and seized 167,464 ETH, 1.615 billion USDT, and about 60 other digital assets, worth an estimated $2.5 billion during a single transaction. Additional Binance hot wallets sent more funds to the same address within 12 minutes. The FBI identified North Korea’s TraderTraitor group as responsible for the attack.
Shortly after the incident, Binance’s emergency SAFU fund and reserves were deployed to compensate users. The exchange managed to cover roughly 95% of user losses, with the remaining amount consisting of less liquid tokens, which require more time to source.
Abu Dhabi’s Financial Services Regulatory Authority said it is “engaging closely with Binance and monitoring the incident” following the hack.
Exchange-traded products and funds are considered safer by some experts in situations like this. Andrew Forson, president of DeFi Technologies, emphasized that holders of ETPs and ETFs “have someone to call if something goes wrong or if assets are lost.” Meanwhile, Standard Chartered analysts suggested the hack could speed up migration to decentralized alternatives like Uniswap.
Circle, the issuer of USDC, reported that more than $1.1 billion in USDC has been frozen in relation to the attack, increasing from the $800 million figure reported by CEO Jeremy Allaire. Tether, another stablecoin issuer, froze a further $1.567 billion in USDT, with the total value of frozen assets across the industry reaching approximately $3 billion.
Mini dictionary: SAFU (Secure Asset Fund for Users) is Binance’s emergency insurance fund, established to protect users by covering losses in extreme cases of security breaches.
