Binance processed about $3.64 billion in net withdrawals during the first nine and a half hours after it began reopening withdrawal services on Sunday, placing the exchange's reserves and recovery plans under immediate scrutiny following a reported $6.3 billion theft from its hot wallets.
The exchange said customers withdrew $4.65 billion and deposited $1.01 billion between 1 a.m. and 10:30 a.m. ET, leaving a net outflow equivalent to 2.1% of the $171 billion in assets it reported in its Oct. 28 proof-of-reserves data. Binance had suspended withdrawals after Thursday's attack, which the company described as the largest crypto theft on record.
The early figures show substantial demand to move assets off the platform, but the withdrawal total remained far below Binance's reported reserve base. Binance said activity was highest shortly after withdrawals reopened, then declined through the morning, while deposits remained elevated.
Withdrawals returned in phases
Binance started restoring withdrawals at 1 a.m. ET, bringing back access in stages rather than reopening every asset and blockchain route simultaneously. The exchange said all 15 networks and assets included in the initial restoration phase were available by 7:36 a.m. ET.
Its public status page illustrated the limits of that recovery process. As of 11:22 a.m. ET, withdrawals remained suspended for 531 of the 552 listed coins. Fourteen other assets had been partly restored, including Bitcoin and Ethereum, while additional networks and tokens remained under testing.
The assets and networks listed as still under review included Cardano, Chainlink, Hyperliquid, Litecoin and NEAR. In practice, the status page means users could face different withdrawal conditions depending on the specific token and blockchain they use, even where the exchange has reopened withdrawals for major assets.
Binance said it was processing withdrawals through newly generated wallets that had been added to its proof-of-reserves list. That operational change follows the theft from its hot wallets, which are internet-connected wallets used to facilitate customer deposits and withdrawals.
On-chain data shows sharp divergence from rivals
Blockchain data platform DefiLlama recorded $4.05 billion in net outflows from Binance over the 24 hours ending at 11:37 a.m. ET. DefiLlama tracked $131.1 billion in assets across wallets associated with the exchange during that period.
The scale of the movement stood apart from flows at other large trading venues tracked by DefiLlama. The next 10 largest exchanges by assets recorded roughly $368 million in combined net inflows over the same 24-hour window, led by OKX with $316.8 million in net deposits.
Not every venue recorded deposits. DefiLlama showed Bitfinex with $106.3 million in net outflows and Gate with $34.5 million in net outflows. Yet the aggregate flow data points to a concentrated response around Binance rather than a broad withdrawal wave across major exchanges.
Coinbase and Kraken are not included in DefiLlama's exchange wallet tracking. CoinGlass data showed their Bitcoin balances rising by about 984 BTC and 1,422 BTC, respectively, over 24 hours, while Binance's Bitcoin balance fell by approximately 19,289 BTC. Such movements can reflect transfers to competitors, private custody, or other wallet arrangements, so wallet balances alone do not identify the destination or motive behind each transfer.
FBI links attack to North Korean group
The Federal Bureau of Investigation attributed the theft to TraderTraitor, a North Korean hacking group, in an alert issued Saturday. The group has been linked by U.S. authorities to previous cryptocurrency thefts and social-engineering campaigns targeting digital-asset firms.
The reported theft has put particular pressure on Binance to show that it can meet withdrawal requests while isolating compromised wallet infrastructure. A suspension after a major security incident can prevent further losses or allow systems to be rebuilt, but it also creates an immediate test of an exchange's operational resilience once customers regain access to their funds.
Richard Teng, chief executive officer of Binance, said Saturday that the company had replenished 90% of the stolen assets and would cover the remainder. Binance said Friday it had prepared $6.34 billion to cover losses tied to the hack.
Those figures suggest Binance is treating the incident as a balance-sheet and infrastructure problem rather than passing losses to account holders. The company's ability to maintain that approach will be judged through the pace of withdrawal restoration, the handling of assets still unavailable for transfer, and the reserves it reports after the attack.
Updated reserve report is due Monday
Binance said it expects to release an updated proof-of-reserves report on Monday using an Oct. 31 snapshot. The report will be computed with zero-knowledge proofs, a cryptographic method designed to allow a company to demonstrate certain information about its holdings without publicly revealing every underlying wallet balance or customer record.
The new report will arrive after the theft and after the first major wave of customer withdrawals, giving users a more current view of the exchange's reported assets than the Oct. 28 reserve snapshot cited in Sunday's update.
For now, the reopening has produced a large but manageable-looking outflow relative to Binance's own reserve figure, alongside a much slower restoration of its full withdrawal network. The gap between those two developments leaves the exchange facing a dual task: meeting demand from users who can withdraw now while safely bringing hundreds of remaining asset routes back online.
Concerned about large exchange hacks? Learn how to safeguard your assets with secure wallet strategies and smarter storage choices.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
