Binance processed $3.64 billion in net outflows on Sunday after reopening withdrawals following a $6.3 billion hack, the largest cryptocurrency theft on record. The outflows represented about 2.1% of the roughly $171 billion in assets held by the exchange.

Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026. By 12:36 UTC, withdrawals had resumed for all assets and networks included in the initial phase, covering 15 networks. The exchange said withdrawal volumes initially spiked but later declined and were stabilising as expected, while deposit volumes remained “substantial.”

Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026. By 12:36 UTC, withdrawals had resumed for all 15 networks and assets in the initial phase. After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit… Binance on X

The incident followed a breach in which most of the stolen assets were taken within about 20 minutes late Thursday. By 03:30 UTC, Binance had processed $4.6 billion in withdrawals against $1 billion in deposits, resulting in net outflows of about $3.6 billion. Binance’s broader figure for Sunday was $3.64 billion.

Different estimates of Binance outflows

Data from DefiLlama showed a higher figure. Its dashboard reported $5.8 billion in net outflows over a 24-hour period, compared with $4.36 billion earlier. The data is available through DefiLlama’s Binance CEX dashboard.

The different totals reflect the measurement period and how transfers are classified. A Binance spokesperson said the DefiLlama figure did not account for funds transferred to the exchange’s own new hot wallet. The spokesperson said Binance’s latest update on X was the closest figure to the accurate total.

The initial withdrawal phase covered tokens across Bitcoin, Ethereum, BNB Smart Chain and XRP Ledger, among other networks. Binance said it would restore additional assets in further phases. Early data indicated that USDT accounted for the largest share of withdrawals, followed by USDC and Bitcoin. Further withdrawal-restoration phases, the exchange’s planned replenishment of its user fund and ongoing efforts to locate or freeze affected assets are the main operational developments identified in Binance’s updates.

Binance says it replaced 95% of stolen assets

Binance said it had replaced about 95% of the stolen assets by purchasing replacement tokens with company funds. The remaining 5% consists of less liquid assets that could take longer to source.

The funds used to cover the losses came from Binance’s Secure Asset Fund for Users, part of its Futures Insurance Fund and the company’s corporate treasury. Co-CEO Yi He said Binance planned to replenish the user fund to approximately $1 billion.

The exchange has set aside about $6.34 billion to cover the losses and has worked with other cryptocurrency firms to freeze some of the affected assets. Approximately $3 billion had been located as of Friday.

Binance Co-CEO Richard Teng described the breach as a “complex attack.” He said it involved a compromised laptop and malicious software designed to delete evidence.

FBI attributes attack to North Korean unit

The FBI said the North Korean state-sponsored group known as TraderTraitor carried out the attack. FBI agents observed members of the unit converting stolen assets into ether, and the agency expects additional laundering of the funds.

Blockchain analytics firms TRM Labs and Chainalysis said the attack resembled earlier thefts attributed to North Korea. North Korea has long denied using state-linked cyber units.

President Donald Trump said Saturday that it remained unclear whether North Korea was involved. “We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it,” he said.

Binance founder Changpeng Zhao thanked US law enforcement for helping track and freeze stolen assets. Binance said it had 335 million registered users worldwide and reported $171 billion in assets as of October 28.

Source: CoinCentral.