Binance posts $3.64B in net withdrawals in first 9.5 hours after reopening

Binance has disclosed $3.64 billion in net outflows in the first 9.5 hours after it reopened phased withdrawals on November 1, 2026, closing the record $6.3 billion hot-wallet theft loop with a measurable but contained user-exit — equal to 2.1 % of the $171 billion in client assets the exchange reports on its latest Proof of Reserves snapshot (October 28). The breakdown is in Binance's own recovery update tweet and reported in parallel by The Block. The exchange says the withdrawal pace is "stabilising as expected" after an initial spike, and that deposit volumes have "remained substantial."

What happened

Binance reopened withdrawals in Phase 1 on November 1 between 06:00 and 09:00 UTC, starting with the Bitcoin network and extending to 15 networks and selected assets per the exchange's Security Incident Recovery Update #4 — covered in our morning walkthrough and in the afternoon FR summary. The withdrawal gate was shut on October 29, immediately after the hot-wallet drain the FBI on October 31 attributed to the North Korean group TraderTraitor.

In the 9.5-hour window from 01:00 to 10:30 ET on Sunday (06:00 to 15:30 UTC), Binance says:

• Withdrawals: $4.65 billion
• Deposits: $1.01 billion
• Net outflow: $3.64 billion

Independent dashboards aligned on the same order of magnitude. DefiLlama showed $4.05 billion in 24-hour net outflows at 11:37 ET — a larger window than Binance's own figure and therefore the slightly higher number. CryptoQuant flagged a combined withdrawal flow of over $4 billion across the same period, with $1.96 billion in USDT, $1.50 billion in BTC, roughly $557 million across other USD-denominated stablecoins, and "hundreds of millions" across ETH and alts (per Cointribune).

Reserve-side, CoinGlass showed Binance's BTC balance drop by 19,289 BTC in the first 24 hours, with Coinbase and Kraken balances rising. The second-order effect — users moving coins from Binance to competitors — is the standard post-incident pattern and is itself a cleaner signal than aggregate price moves.

Mechanism — Phase 1 scope and queue dynamics

Phase 1 is selective, not full. Of 552 listed coins, Binance's withdrawal page at 11:22 ET still showed roughly 531 in suspended state; the open set is the ten assets the exchange reports as 100 % backed in its PoR (BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, ZEC) across the Phase-1 networks. Users holding anything outside that pool cannot withdraw yet.

The spike-then-stabilise shape of the outflow is consistent with a sequential-queue reopening: users with pending withdrawal tickets from pre-pause are serviced first, which concentrates the initial flow, and the system throttles back as the backlog clears and only fresh requests remain. Binance has not disclosed queue size or median withdrawal latency during the window.

Numbers block

- Hack total                           : $6.3B (29 October 2026)
- Withdrawal pause                     : 29 October – 1 November 2026
- Phase 1 reopen window                : 1 November, 06:00–09:00 UTC
- Period measured                      : 1 November, 06:00–15:30 UTC (9.5h)
- Withdrawals in window                : $4.65B
- Deposits in window                   : $1.01B
- Net outflow                          : $3.64B
- Binance client assets (28 Oct PoR)   : $171B
- Net outflow as % of client assets    : 2.1 %
- DefiLlama 24h net outflow (11:37 ET) : $4.05B
- BTC off Binance (24h, CoinGlass)     : -19,289 BTC

Impact

For Binance's balance sheet: a 2.1 % net outflow in a half-day is sizeable but far from a run. The relevant comparator is historical panic events — FTX collapse period in November 2022, when Binance saw multi-day net outflows that eventually topped $6 billion over a week. This hack's one-day shape is of similar scale but more compressed, consistent with queued-request release rather than a continuing panic.

For custody competitors: the mirror outflow is a short-window boost for Coinbase, Kraken and non-custodial setups. The permanence of that shift depends on whether Binance's updated POR with zk-proofs — the exchange has pre-announced an October 31 snapshot release for Monday November 2 — matches the asset-backing picture it is painting now.

For stablecoin flows: USDT absorbed about $1.96 billion of the first-day outflow and USDC some portion of the "other USD stablecoin" bucket, confirming that most of what left Binance is sitting in stablecoin form rather than hitting fiat rails.

What to watch

1. The Monday November 2 Proof-of-Reserves release: snapshot date, auditor, and whether zk-proofs cover the remaining 5 % that Binance has committed to buy back on-market.
2. Phase 2 scope — the remaining ~531 coins and the networks beyond the Phase-1 fifteen.
3. Day-2 net flow: if deposits catch up to withdrawals within 48 hours, the event is essentially closed; if net outflow continues at the Day-1 pace into Day 3, that is a different story.
4. CZ and Richard Teng communications: Teng has carried the public line so far; CZ has not posted recovery-update numbers.

Context — exchange-run precedents

A one-day $3.64 billion net outflow equal to roughly 2.1 % of AUM is unusual but not unprecedented. The FTX November 2022 run peaked at a roughly comparable share of AUM per day but on a smaller base and ended in insolvency. Binance's November 2022 FUD-driven outflow period and the May 2024 DMM-adjacent episode produced similar single-day numbers against larger bases and ended with net flows reversing within a week. The hack-specific comparator is Mt. Gox 2014 — the only one where a withdrawal reopening preceded a terminal failure. Nothing in today's data suggests that trajectory; the number to watch is the one Binance publishes tomorrow.