Key Takeaways
- Net outflows equaled approximately 2.1% of Binance’s reported assets.
- All withdrawal routes in the initial phase reopened by 12:36 UTC.
- An updated proof-of-reserves report was expected Nov. 2.
Withdrawal Volumes Stabilize After Initial Spike
Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC on Nov. 1, following its withdrawal restart after the $6.3 billion hack. In its withdrawal and deposit update, the exchange said withdrawal volumes had declined and were stabilizing after an initial spike. Net outflows totaled approximately $3.64 billion, equivalent to 2.1% of its reported assets under management.
The crypto exchange stated:
“Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026. By 12:36 UTC, withdrawals had resumed for all 15 networks and assets in the initial phase.”
The comparison used $171 billion in assets under management from proof-of-reserves data dated Oct. 28. The earlier recovery plan required security checks and validation before withdrawals returned, while deposits stayed operational. The exchange continued testing networks and assets outside the initial phase.
The three charts below track withdrawals, deposits, and net flows in 30-minute intervals. The top chart separates withdrawals by cryptocurrency, showing a $733 million peak in the interval beginning at 08:00 UTC; the middle chart shows deposits peaking at $187 million at 08:30 UTC. The bottom chart subtracts withdrawals from deposits, with red bars indicating net outflows in every interval, while black lines across all three panels track cumulative totals.
Restored Routes Span 15 Networks
Availability depends on the asset and network pair: the cryptocurrency being withdrawn and the blockchain carrying the transfer. Binance’s deposit and withdrawal status allows customers to check their chosen route. Restored options included BTC on Bitcoin, XRP on the XRP Ledger, DOGE on Dogecoin, ETH, USDT, and USDC on Ethereum, and BNB, USDT, and USDC on BNB Smart Chain.
Base, Optimism, and Arbitrum are Ethereum scaling networks designed to process transactions at lower cost. Base withdrawals covered ETH and USDC, while Optimism supported ETH, USDT, and USDC; Arbitrum also included ARB. The restored asset and network list also covered SOL, USDT, and USDC on Solana, ZEC on Zcash, USDT and GRAM on TON, and SUI on Sui.
Tron, Polygon, and Avalanche C-Chain support transfers of their own tokens and other cryptocurrencies. Restored withdrawals included TRX and USDT on Tron, POL, USDT, and USDC on Polygon, and AVAX, USDT, and USDC on Avalanche C-Chain. Customers could also resume bitcoin transfers to external addresses, with Binance warning that traffic could temporarily delay processing.
Asset Replacement Reaches 95%
Replenishment increased from the 90% level disclosed previously to approximately 95% of the impacted amount. That figure measured replacement of affected assets using company resources, rather than stolen funds returned by attackers. Purchases continued through market and over-the-counter channels to source the remaining less liquid tokens.
The exchange’s fourth recovery update reported that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances were fully backed. A new reserve snapshot was taken at 00:00 UTC on Oct. 31, with an updated report expected Nov. 2. Generation of its zero-knowledge proof, which verifies reserve calculations without exposing individual customer balances, was underway.
Separately, the Federal Bureau of Investigation (FBI) attributed the theft to North Korea on Oct. 31. The bureau linked it to TraderTraitor, its name for the North Korean cyber activity involved, and observed stolen assets being converted primarily into ether. Binance committed to publishing a post-incident report once its investigation concludes.
