Binance has restored cryptocurrency withdrawals across 15 networks in its initial reopening phase following the largest crypto theft on record. Customers withdrew approximately $4.65 billion
Binance has restored cryptocurrency withdrawals across 15 networks in its initial reopening phase following the largest crypto theft on record. Customers withdrew approximately $4.65 billion during the first nine and a half hours, while deposits exceeded $1 billion.
The resulting net outflow was approximately $3.64 billion, equivalent to 2.1% of the exchange’s reported $171 billion in assets under management before the attack. Binance said withdrawal demand eased after an initial surge as customers regained access to their funds.
The reopening marks an important recovery milestone after approximately $6.3 billion was stolen on October 29. However, access remains dependent on the specific asset and network, and the exchange continues to restore services in stages.
Binance Restores Withdrawals Across 15 Networks
Binance began reopening withdrawals at 06:00 UTC on November 1. According to the statement supplied from its official X account:
Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026. By 12:36 UTC, withdrawals had resumed for all 15 networks and assets in the initial phase. After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial.
The restored networks include Bitcoin, Ethereum, BNB Smart Chain, XRP Ledger, Base, Dogecoin, Optimism, Arbitrum, Tron, Solana, Polygon, Avalanche C-Chain, Zcash, TON and Sui.
Availability varies by asset. Ethereum withdrawals include ETH, USDT and USDC, while BNB Smart Chain supports BNB and the two stablecoins. Other restored routes include BTC on Bitcoin, XRP on XRP Ledger, DOGE on Dogecoin and SUI on Sui.
Binance’s official recovery announcement says additional networks and assets will return after security and operational checks. It also warns that increased traffic may cause temporary delays during the rollout. Restoring 15 networks therefore does not mean every listed cryptocurrency is available for withdrawal.
What the $3.64 Billion Net Outflow Actually Means
The exchange’s figures cover 06:00–15:30 UTC on November 1: precisely nine and a half hours, rather than a full ten hours.
During that period, Binance processed $4.649 billion in withdrawals and received $1.01 billion in deposits. Subtracting deposits from withdrawals produces a net outflow of $3.639 billion, rounded to $3.64 billion.
The 2.1% comparison uses Binance’s reported $171 billion in assets from its October 28 proof-of-reserves data. That is a pre-attack reference point, not a fresh measurement of assets remaining after the reopening.
Separately, CoinDesk reported approximately $6.1 billion in Binance-linked wallet outflows over a subsequent 24-hour window, citing DefiLlama. It cautioned that publicly tracked movements can include transfers between exchange-controlled wallets.
That distinction matters when comparing figures. Gross withdrawals, net outflows and movements between identified wallets measure different things. A circulating $5.142 billion figure without a source, timestamp or methodology cannot reliably be compared with Binance’s nine-and-a-half-hour total.
For the same reason, changing dashboard readings should always be presented with their observation time.
CZ Praises Customer Trust as Rival Exchanges Receive Deposits
Former Binance chief executive Changpeng Zhao responded to the reopening with the following statement, supplied from his X account:
12 hours after withdrawals resumed: 2.1% net outflow, with most occurring in the first couple of hours. Over $1 billion in flow, too.
98% choose to stay!
Trust isn’t earned by what you say in good times. It’s earned by what you do in hard times.
Thank you for your trust!
The “98%” statement expresses Zhao’s interpretation of asset flows. It does not establish that 98% of customers decided to remain: an asset-value percentage cannot measure individual account decisions.
His reference to 12 hours also differs from the nine-and-a-half-hour period underlying Binance’s published calculation.
Meanwhile, CoinDesk reported approximately $450 million in net inflows at OKX and $134 million at Bybit during its observation window. Those figures show deposits reaching competitors, but do not establish how much originated directly from Binance.
Claims that most departing funds went to those exchanges or to hot and cold wallets require transaction-level evidence. A blockchain transfer alone generally cannot establish how a recipient stores its private keys.
Fiat Withdrawals Expand as Reserve Reporting Continues
Binance also announced the restoration of fiat withdrawals for five additional currencies: the US dollar, UAE dirham, Vietnamese dong, Philippine peso and Indonesian rupiah.
These joined 23 currencies already listed as available, bringing the announced total to 28. Existing options included EUR, GBP was not listed, and currencies such as JPY, BRL, MXN, CHF, PLN and HUF remained among those available. Customers still need to check the options offered for their account and region.
Alongside service restoration, Binance announced a new proof-of-reserves snapshot taken at 00:00 UTC on October 31. Its November 1 update said zero-knowledge-proof computation had begun and the updated report was expected on November 2. That was a publication target, rather than confirmation that the completed report was already available.
The snapshot’s timing is important: October 31 predates the November 1 withdrawal reopening. It can provide information about reserves at that earlier point, but cannot by itself describe balances after subsequent customer withdrawals.
Investigation Update: FBI Attributes the Hack to North Korea
The attack occurred on October 29, although major investigation updates followed on October 30. Binance said compromised hot wallets lost approximately $6.3 billion in token assets.
The exchange’s initial findings pointed to a compromised laptop, but subsequent investigation uncovered additional breach points. In its October 30 update, Binance said it had found no evidence that wallet private keys were leaked. It also reported approximately $3 billion frozen on-chain and more than $6.34 billion in company funds allocated to cover the incident.
The FBI has since formally attributed the theft to North Korea’s TraderTraitor actors. The agency said it observed stolen assets being converted primarily into ETH and called for industry cooperation to prevent further laundering.
By November 1, Binance said it had replenished approximately 95% of affected assets. The remaining portion consisted of less-liquid tokens requiring additional purchases. Replenishment uses company resources; it should not be confused with recovering funds from the attackers.
Further recovery updates and a completed technical investigation remain central to assessing Binance’s response beyond the initial reopening.
