Binance reopened withdrawals for Hyperliquid (HYPE), the native token of the decentralized trading protocol Hyperliquid, and Aptos (APT), the native asset of the layer-1 blockchain Aptos, on Sunday, Nov. 8, moving ahead of the timeline it had communicated to users. The restoration comes as the exchange continues to recover from a $6.3 billion security breach that took place on Oct. 29. Binance had said on Nov. 6 that it aimed to restore withdrawals for these assets by the end of the following week.

In an announcement posted to X, the exchange confirmed the latest assets to be re-enabled:

Latest Withdrawal Update

Withdrawals have now been re-enabled for the following networks and assets:

New: ✅ HYPE ✅ APT

Already Enabled: ✅ ETH: RLUSD, USD1, TUSD, FDUSD, XUSD ✅ ETH: ENA, USDE, PENDLE, WLD, QNT, SHIB, ZRO, FET, NIL, ONDO, ALT, SKY, LINK, ETHFI, REZ,…

— Binance (@binance) November 8, 2026

While the withdrawal notices trace the phased recovery, on-chain data shows how substantially the exchange's holdings have changed since the attack. Reserve levels are among the most closely watched on-chain metrics during a post-incident recovery, because they measure how much customer crypto sits on a platform at any given time.

What the Reserve Data Shows

CryptoQuant data through Nov. 8 shows Binance's bitcoin reserves fell from about 730,000 BTC before the attack to 673,700 BTC — a decline of roughly 56,000 BTC, or 7.7%. At Sunday's bitcoin price of $75,800, that difference is worth approximately $4.2 billion.

The heaviest outflows occurred between late October and early November. Daily bitcoin net outflows reached about 14,500, 22,000, 16,500 and 9,000 BTC across the period, with the 22,000 BTC reading standing as the largest daily net outflow recorded in the past 12 months. Flows have since settled: one session registered a positive 10,400 BTC, and the most recent reading showed about 1,300 BTC in net inflows.

Ethereum reserves followed a similar pattern, falling from about 3.48 million ETH to 3.08 million ETH — a drop of 400,000 ETH, or 11.5%. Two daily readings came close to negative 175,000 ETH and negative 155,000 ETH, and the latest daily flow remained negative at roughly 5,500 ETH.

Ethereum-based stablecoin reserves recorded the steepest percentage decline. They fell from about $41 billion before the hack to $32 billion on Nov. 8, a reduction of $9 billion, or 22%. Two daily outflows reached approximately $3.3 billion and $3.6 billion — roughly triple the largest daily withdrawal observed earlier in 2026. The latest stablecoin reading showed a net inflow of about $27.9 million.

CryptoQuant's figures include movements tied to the theft and the hacker, and its stablecoin data covers only Ethereum-based tokens. The numbers differ from the $3.64 billion in net customer withdrawals that Binance itself reported earlier — a figure equal to about 2.1% of the platform's reported assets.

Arkham Intelligence presents a different accounting. The analytics firm places Binance's labeled holdings at about $162.65 billion across 68.5 million addresses, counting roughly 696,184 BTC and 3.454 million ETH — totals higher than CryptoQuant's. The discrepancy stems from the two firms' differing wallet labeling and reporting methods. That gap underscores a recurring feature of on-chain analytics: depending on how wallets are attributed, reserve tallies can capture the hacker's own transfers alongside genuine user activity, so the snapshots reflect methodology as much as raw flows.

How the Withdrawal Recovery Has Progressed

Binance began reopening withdrawals on Nov. 1, starting with bitcoin and selected assets across 15 blockchain networks. On Nov. 3, it added Ethereum and Solana tokens, and a later round covered 51 more assets, including Chainlink, Shiba Inu, Bonk and Official Trump. Pausing withdrawals and restoring them asset by asset is a standard incident-response sequence after a major breach, with each asset returning only once internal security reviews clear it.

The exchange says it is restoring assets in phases as security checks are completed. According to Binance, asset replenishment stood at about 95% by the first reopening and reached about 98% by Nov. 4. The company noted that the remaining purchases have been more difficult because some tokens have limited liquidity.

Blockchain investigators and U.S. authorities have linked the attack to North Korean hackers, and it stands as the largest crypto theft on record in dollar terms, surpassing the roughly $1.5 billion taken from Bybit in February 2025 — a breach investigators also tied to North Korean-linked actors. Elliptic reported that the attackers swapped about $174 million in stolen altcoins into roughly 2,300 BTC.

Binance has committed to covering customer losses with corporate funds and its Secure Asset Fund for Users — the emergency fund the exchange set up in 2018 to absorb extreme losses — and plans to restore that fund to about $1 billion.

As of Nov. 8, Hyperliquid traded near $77.12, down about 2.47% over 24 hours and 11.98% across seven days. Aptos traded near $0.5944, down 1.16% on the day and roughly 6.8% on the week.

Binance has not said whether Injective, Plasma, Near and Litecoin — the four assets named on the Nov.6 list — have completed their security checks. The exchange says further updates will be provided through its official channels.

Source: CoinCentral