TLDR
- Binance saw $3.64 billion in net outflows, about 2.1% of its assets, after reopening withdrawals on Sunday.
- DefiLlama data showed higher net outflows of $5.8 billion over 24 hours, which Binance says is not accurate.
- Binance has replaced about 95% of the $6.3 billion in stolen assets using company funds.
- The FBI says North Korea’s TraderTraitor unit carried out the attack, while President Trump says it is unclear.
- Withdrawals are opening in phases, starting with 15 networks.
Binance customers withdrew $3.64 billion on Sunday as the exchange went back online. That is about 2.1% of the roughly $171 billion in assets it holds. The exchange said it began restoring withdrawals at 6:00 UTC.
Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026. By 12:36 UTC, withdrawals had resumed for all 15 networks and assets in the initial phase. After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit… pic.twitter.com/ZSnYGCTp9d
— Binance (@binance) November 1, 2026
The move followed a $6.3 billion hack, the largest crypto theft on record. The bulk of the theft happened in about 20 minutes late on Thursday.
By 3:30 UTC, Binance had processed $4.6 billion in withdrawals against $1 billion in deposits. That left net outflows of $3.6 billion.
Binance said withdrawals surged at first but have slowed and are stabilizing. It added that deposit volumes remained “substantial.”
Data Sources Show Different Numbers
DefiLlama reported higher figures. Its dashboard showed $5.8 billion in net outflows over 24 hours, up from $4.36 billion earlier.
A Binance spokesperson said the data does not include funds moved to its own new hot wallet. The spokesperson said the exchange’s latest update on X is closest to accurate.
Binance’s latest update showed withdrawals enabled for tokens across 15 networks. These include Bitcoin, Ethereum, BNB Smart Chain and XRP Ledger. The exchange said it will restore more assets in phases.
Early data showed USDT had the largest share of withdrawals. USDC and Bitcoin followed.
How Binance Is Covering the Losses
Binance said it has covered 95% of the stolen assets. It bought replacement tokens using company money. The remaining 5% are less liquid assets and may take longer to source.
The funds came from its Secure Asset Fund for Users, part of its Futures Insurance Fund and its corporate treasury. Co-CEO Yi He said the company plans to refill the user fund to about $1 billion.
Binance has set aside about $6.34 billion to cover the losses. It has also worked with other crypto firms to freeze some of the affected assets. About $3 billion was located as of Friday.
Co-CEO Richard Teng called the breach a “complex attack.” He said it involved a compromised laptop and malicious software built to delete evidence.
Who Was Behind the Attack
The FBI said the North Korean state-sponsored unit known as TraderTraitor was responsible. Agents saw members of the unit converting stolen assets into ether. The agency expects further laundering of the assets.
TRM Labs and Chainalysis said the attack resembled earlier thefts blamed on North Korea. North Korea has long denied using state-linked cyber units.
President Donald Trump said Saturday it remained unclear whether North Korea was involved. “We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it,” he said.
Binance founder Changpeng Zhao thanked US law enforcement for helping track and freeze stolen assets. Binance has 335 million registered users worldwide. It reported $171 billion in assets as of October 28.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.







