Mentioned in This Article
1. Binance outflows top $6 billion after the freeze ends
More than $6 billion in assorted tokens left Binance-linked wallets in the first 24 hours after the exchange lifted its withdrawal freeze on Sunday, November 1. Withdrawals had been halted after an October 29 hack that removed about $6.3 billion in cryptocurrency, the largest theft of its kind on record. The outflows show how customers behaved once they regained access.
The figure is large in absolute terms but modest against the platform's overall balance sheet. It is equal to roughly 3.6% of the $171 billion in assets that Binance reported holding before the attack. In other words, the great majority of the funds that sat on the exchange before the breach were still there after the first day of open withdrawals.
The numbers come from public wallet movements compiled by the analytics platform DefiLlama, and they should be read with some care. Tracking of this kind can capture transfers between wallets that the exchange itself controls, so not every token counted as an outflow necessarily belongs to a customer who chose to leave.
2. How much does Binance still hold?
After the withdrawals, DefiLlama continued to track about $129 billion in assets across Binance-linked wallets. That is a substantial reserve even after the losses from the theft and the first day of redemptions, and it is the main reason analysts describe the withdrawal wave as contained rather than a run on the exchange.
The $129 billion estimate is not an audited number and should not be treated as one. DefiLlama's wallet coverage and the way it values assets differ from the reserve figures that Binance itself publishes, so the two sets of data will not match exactly. Readers comparing the pre-hack total of $171 billion with the later $129 billion should keep in mind that the first comes from the exchange's own reporting, while the second comes from an outside tracker's methodology.
That difference in sources means the gap between the two totals cannot be attributed entirely to the hack and the subsequent withdrawals. It also explains why the share of funds that left, about 3.6%, is the more useful figure for judging customer reaction: it was calculated against the pre-attack holdings the exchange reported.
Context helps here. An exchange that holds well over a hundred billion dollars in customer and corporate assets is expected to see some turnover in ordinary times, and a security incident of this scale would be expected to raise it. The relevant question is whether the departures remain a small fraction of the total or grow into a self-reinforcing rush, and the first day of data points to the former.
3. A 45-hour freeze and the timeline of the reopening
Withdrawals on the platform had been suspended for about 45 hours. The pause began after the October 29 attack, in which hackers took around $6.3 billion in digital assets. Halting outbound transfers is a standard emergency step for an exchange facing a breach, because it prevents further losses and gives engineers time to secure signing systems and wallets, but it also leaves customers unable to reach their own funds.
Binance began restoring withdrawals at 06:00 UTC on Sunday, November 1. The restart was staged. By 12:36 UTC, all 15 networks and assets in the first phase of the reopening were available for withdrawal, a group that included bitcoin (BTC), ether (ETH), solana (SOL), XRP and the major stablecoins.
Starting with the most widely held assets is a common way to manage a reopening. Those tokens carry the deepest liquidity and the highest customer demand, so restoring them first addresses the needs of most account holders while the exchange works through the remaining assets in later phases.
The length of the freeze is itself part of the story. Roughly two days without access to funds is a long interruption for a platform that customers use for active trading, and it meant that traders who wanted to reduce exposure, move collateral or rebalance portfolios could not do so while markets continued to move. Pent-up demand of that kind naturally shows up as a burst of activity at the moment of reopening.
4. Withdrawals outran deposits in the first hours
In the first nine and a half hours after the restart, Binance processed $4.649 billion in withdrawals against $1.01 billion in deposits. That left a net outflow of $3.64 billion for the period, meaning that for every dollar that came in, more than four dollars went out.
The company said demand to withdraw surged immediately after the reopening and then eased, while deposits remained substantial. That pattern is typical of an event in which the most cautious users act at the first opportunity, and it suggests the heaviest pressure came at the very start rather than building over time.
Deposits of more than $1 billion over the same stretch are also notable. They show that a meaningful number of customers and traders were still moving funds onto the platform even as others took theirs off, which points to a market in which confidence has been shaken but not eliminated.
A net outflow of $3.64 billion in less than ten hours is a heavy flow by any standard, but it must be weighed against the scale of the exchange. Binance serves a global customer base that includes retail users, professional traders and institutions, and each group has different reasons to keep or remove funds. Active traders often hold balances on an exchange precisely because they intend to trade, while long-term holders are more likely to treat a breach as a prompt to move assets into their own custody.
5. Where did the money go?
Rival exchanges were among the visible beneficiaries. OKX recorded about $450 million in net inflows, and Bybit received roughly $134 million. Both platforms saw deposits rise as Binance users regained the ability to relocate their assets.
These figures need a caveat. Public aggregate data shows the amounts arriving at each venue, but it does not identify the origin of those funds. It is therefore not possible to say how much of the money that reached OKX and Bybit came directly from Binance accounts, and how much reflects ordinary trading flows or transfers from other sources.
Money leaving an exchange does not always go to another exchange, either. Some holders withdraw to self-custody wallets, a practice that often accelerates after a security incident at a large platform, because it removes counterparty risk even if it places the burden of safekeeping on the user.
6. How much of the stolen crypto has Binance replaced?
On November 1, Binance said it had replenished about 95% of the assets affected by the hack. Replacing stolen holdings matters because an exchange is expected to keep customer balances fully backed. Restoring them allows the platform to honor withdrawals without relying on the remaining funds of other users.
The remaining 5% consists mainly of less liquid tokens, which take longer to acquire. Markets for smaller assets are thinner, and buying large quantities quickly can move prices against the buyer, so rebuilding those positions tends to be a slower, more careful process than replacing major assets such as bitcoin or ether.
The progress on replenishment helps explain why the early reaction has been measured. A platform that can show customer assets are largely restored, and that is processing billions of dollars in withdrawals without interruption, gives users less reason to rush for the exit than one that is still short of funds.
Until the final portion is acquired, the 95% figure is the best available measure of how far the restoration has progressed.
7. What the first day of data does and does not show
Taken together, the figures describe an exchange that endured a large outflow but kept the bulk of its assets. A reduction of 3.6% of pre-hack holdings in a day is significant, yet it is far from the kind of drain that would threaten the solvency of a platform of this size, especially with replenishment largely complete.
At the same time, a single day is a short window. The outflows measured so far reflect users who acted at the first opportunity. Whether additional customers decide to leave in the following days and weeks will depend on factors that the early data cannot capture, including the results of the exchange's investigation, the pace of its security upgrades and the completion of the remaining phases of the reopening.
The caveats on the data also remain. Because the DefiLlama tracking can include internal transfers, and because the exchange's own reserve figures follow a different method, the outflow total should be treated as an estimate. Binance's own statements about deposits, withdrawals and replenishment are the other main reference points for judging the recovery.
8. What to watch next
The next markers are the completion of the reopening beyond the initial 15 networks and assets, and the exchange's progress in acquiring the last 5% of the tokens it still needs to replace. Both will indicate how quickly Binance returns to normal operations. Together, those developments will show whether the exchange has regained the trust of its users.
Observers will also track whether net outflows continue or whether deposits begin to catch up with withdrawals, and whether the inflows recorded at OKX and Bybit persist. If withdrawals taper and deposits stabilize, the first day will look like a one-time release of pent-up demand rather than the start of a lasting shift of customers away from the exchange.