Binance experienced net outflows of approximately $3.64 billion within nine and a half hours following the reopening of cryptocurrency withdrawals on November 1. This surge in customer fund transfers came after a record $6.3 billion security breach at the exchange.
Large Customer Withdrawals After Security Incident
Between 06:00 and 15:30 UTC, Binance processed withdrawals totaling $4.65 billion and saw $1.01 billion in deposits, according to figures reported by Reuters. The net outflow represented about 2.1% of Binance’s stated $171 billion in assets.
Many users acted quickly once withdrawal services returned, withdrawing billions shortly after the security incident. Binance restored withdrawals in phases, starting with Bitcoin, Ethereum, and major stablecoins before extending the service to a broader range of cryptocurrencies.
The phased reopening followed the discovery that, on October 29, hackers took roughly $6.3 billion from Binance’s hot wallets, spanning several blockchain networks. Binance responded by replacing nearly all of the stolen assets for its customers within days.
Withdrawal activity initially surged, then began to decline, while deposits remained steady. DefiLlama’s independent tracking recorded about $4.05 billion in net outflows over a 24-hour period, though the timing of these figures varies compared to Binance’s reported window.
Activity data indicate customers withdrew $4.65 billion and deposited $1.01 billion, with the exchange restoring 95% of assets affected by the incident.
Binance’s quick restoration of most customer balances has not fully resolved concerns about user confidence in the exchange’s long-term security and operational resilience.
Asset Recovery Efforts Continue
Binance has emphasized that users will not bear any losses resulting from the incident. The exchange is covering the cost of replacing stolen crypto by drawing from company reserves and its Secure Asset Fund for Users (SAFU). The team continues working with blockchain projects to trace and recover stolen assets.
The breach reportedly began with an attack on around $296 million in XRP, later spreading into Bitcoin, Ethereum, and other digital currencies. Investigators have identified significant volumes of Ethereum controlled by those responsible for the theft, prompting vigilance around potential further movement of these coins.
Binance and blockchain partners managed to freeze about $3 billion of compromised funds. Ripple also intervened by freezing RLUSD, an action highlighting the capacity of centralized stablecoin issuers to restrict stolen assets, even after blockchain-based thefts.
It is important to distinguish between replacing stolen tokens with new ones and recovering the actual missing coins. Binance continues to replenish reserves from its own resources while ongoing investigations attempt to recover original assets on-chain.
The exchange has stated that 95% of affected assets have been replaced. Replacing the outstanding 5%—mostly consisting of less-liquid tokens—will require more time.
The remaining unreplaced assets largely include illiquid cryptocurrencies, while major assets have been restored using Binance’s corporate resources and SAFU.
This recent wave of withdrawals has tested Binance’s liquidity and the confidence of its user base. Despite the sizable outflows, they accounted for a relatively minor portion of Binance’s reported holdings. The company has reiterated that customer withdrawals are stabilizing and that balances for principal cryptocurrencies are fully backed.
Market repercussions reached beyond the exchange. The price of Bitcoin dipped below $77,000, resulting in approximately $1.53 billion in crypto liquidations. BNB also fell sharply, declining 8% during the initial market response.
As customers monitor the immediate and potential long-term impacts of this security breach, market participants face heightened uncertainty. For those closely following rapid on-chain flows and real-time changes in major tokens, tools like CryptoAppsy’s live price charts and customizable portfolio tracking provide critical support. CryptoAppsy enables users to watch the performance of their assets and set alerts for key cryptocurrencies, allowing investors to manage risk and respond quickly as new developments continue to shape sentiment post-incident.
