Binance users withdrew a net total of roughly $3.64 billion after the exchange reopened withdrawal services on November 1, according to figures disclosed by the company. The outflow represents 2.1% of the roughly $171 billion in assets held on the platform, the exchange said.

Phased restoration and first-day flows

Binance began a phased restoration of withdrawals at 06:00 UTC on November 1. All 15 networks and assets included in the first phase were live by 12:36 UTC, the exchange said in a post on X.

Between 06:00 and 15:30 UTC, Binance processed $4.649 billion in withdrawals, while deposits over the same window totaled $1.01 billion, trimming the size of the exit. The 2.1% figure is based on Proof of Reserves data as of October 28 — the industry-standard practice of publishing on-chain wallet balances so outsiders can independently check what an exchange actually holds. Withdrawal volumes spiked when the service reopened, then eased and stabilized, the exchange said, adding that deposit volumes remained significant.

Founder Changpeng Zhao said most of the net outflow occurred within the first couple of hours after withdrawals resumed. “98% choose to stay!” Zhao posted on X.

Binance also took a new Proof of Reserves snapshot at 00:00 UTC on October 31 — the first since the hack — and initiated the zero-knowledge proof computation, the cryptographic technique that lets users verify reserves without individual account balances being exposed, with the updated report expected on its reserves website the following day.

The company said market conditions remain stable. “It has not yet triggered widespread panic or a massive, concentrated withdrawal,” said Tim Sun, a senior researcher at HashKey Group. Analysts said the hack is likely to slow institutional buying of crypto for a while.

Circle’s USDC freeze climbs past $1.1 billion

The outflows followed the theft of about $6.3 billion on October 29, which Cryptopolitan reported as the biggest hack in the history of crypto. Freeze measures imposed after the incident have ended alongside the reopening of withdrawals.

Binance’s preliminary investigation points to a compromised laptop belonging to a DevOps engineer, which the attacker used to access an internal service container and force unauthorized withdrawals.

The funds were drained from Binance 14, one of the exchange’s most active Ethereum hot wallets, according to security firm Blockaid. Hot wallets are the internet-connected wallets exchanges use to process day-to-day customer withdrawals — the setup that keeps trading liquid, but also the most exposed part of an exchange’s custody stack. At 20:20 UTC on October 29, a transaction carrying 50 signed authorizations handed the wallet to a sweeper contract, a program that automatically redirects any funds later sent to the address it controls. Minutes later, Binance 14 lost 167,464 ETH, 1.615 billion USDT and about 60 other tokens, worth roughly $2.5 billion. Another ten Binance hot wallets channeled funds to the same address within 12 minutes.

The FBI has attributed the attack to North Korea’s TraderTraitor operation. Across the industry, about $3 billion has been frozen on-chain, including $1.567 billion in USDT frozen by Tether — a lever that exists because stablecoin issuers hold blacklisting controls at the token-contract level, allowing flagged addresses to be blocked from transfers. A Circle spokesperson said the company’s USDC freeze now surpasses $1.1 billion, up from the more than $800 million CEO Jeremy Allaire initially cited.

Binance said its SAFU emergency fund — the insurance reserve the exchange has maintained since 2018 — and reserves would cover user losses. About 95% of the affected amount has been covered, up from 90%, with the remaining 5% in less liquid tokens that take longer to procure. How quickly that last 5% is procured is the near-term measure of how fully affected users are made whole.

Regulatory and industry response

ETPs and ETFs provide holders with “someone to call if something goes wrong or if assets are lost,” said Andrew Forson, president of DeFi Technologies. Analysts at Standard Chartered say the hack could accelerate a move toward decentralized exchanges such as Uniswap.

The Financial Services Regulatory Authority (FSRA), which licenses Binance’s operations within Abu Dhabi Global Market (ADGM), the emirate’s international financial center, said it was “engaging closely with Binance and monitoring the incident.”