Binance processed more than $7 billion in net withdrawals in the 24 hours after reopening its withdrawal system on Nov. 1, yet on-chain data showed little evidence that most of the funds moved directly to competing centralized exchanges. The outflows followed a reported $6.3 billion theft from one of the exchange's hot wallets on Oct. 30 and put Binance's reserves, restoration plan and liquidity arrangements under immediate public scrutiny.
During the first nine hours after withdrawals resumed at 15:00 UTC+8 on Nov. 1, customers withdrew $4.649 billion and deposited $1.01 billion, producing net outflows of about $3.64 billion, according to figures provided by Binance. That represented roughly 2.1% of the platform's $171 billion in assets under management from an Oct. 28 snapshot.
DefiLlama recorded net outflows of $7.034 billion over the full 24-hour period after the restart. The scale of the withdrawals reflects a familiar response to a major exchange security breach: customers seek immediate access to funds while the platform works to demonstrate that it can meet redemption requests without delays or restrictions.
Withdrawals returned across 15 networks
Binance said that by 23:30 UTC+8 on Nov. 1 it had restored a first group of withdrawal services spanning 15 networks and assets. The initial coverage included Bitcoin, Ethereum mainnet, BSC and Solana, giving customers access to several of the networks most commonly used for exchange transfers and stablecoin settlement.
The phased approach meant that not every asset was immediately available for withdrawal. Binance said around 95% of the assets affected by the incident had been replenished before withdrawals resumed. The remaining 5% involved lower-liquidity tokens outside the largest cryptocurrencies, where sourcing inventory and rebuilding wallet balances can take longer.
The exchange also added new wallet addresses to its proof-of-reserves address list and routed withdrawals through those addresses. That operational change led to public attention around large Bitcoin transfers that blockchain trackers had labeled as exchange funds moving to unidentified wallets.
Zhao said those transfers were connected to the new proof-of-reserves addresses rather than unexplained transfers away from the platform. Such address changes can create uncertainty in the immediate aftermath of a hack because blockchain data can show the movement of funds without revealing whether a wallet is controlled by an exchange, a custodian, a market maker or an individual.
Rival exchanges did not receive a matching surge
The withdrawal data points more toward a move into self-custody or other destinations than a broad migration from Binance to rival trading venues. Over the same 24-hour period, the nine exchanges ranked immediately below Binance by reserves recorded combined net inflows of about $750 million, according to DefiLlama.
That gap between Binance's $7.034 billion in net outflows and the relatively modest inflows at the next-largest platforms suggests customers were not collectively shifting their balances into a single group of competitors. Some funds may have moved to private wallets, decentralized finance protocols, payment services, market makers or venues outside the group measured.
The distinction matters for Binance's trading activity. A transfer from an exchange into a personal wallet reduces readily available exchange liquidity, while a transfer to another major venue can also shift spot and derivatives volumes away from the original platform. The available flow data shows a sharp reduction in balances held at Binance, but not a matching transfer of market share to its nearest centralized rivals during the first day.
Proof-of-reserves report is due Nov. 3
Binance took a fresh proof-of-reserves snapshot on Oct. 31 at 08:00 UTC+8, after the reported theft and before withdrawals resumed. Its proof-of-reserves website listed reserve ratios of 100% or more for major assets, while the exchange scheduled a full report for Nov. 3.
Proof of reserves generally uses blockchain addresses and customer-liability data to show whether an exchange holds enough assets to cover user balances. It can offer a near-term view of wallet holdings, although the quality of a report depends on how liabilities, pledged collateral and address ownership are presented.
In this case, the forthcoming report will be closely watched for the treatment of replenished funds, the newly added addresses and the reserves supporting assets whose withdrawals were restored later than the major networks. The snapshot came after Binance said it had rebuilt most of the assets affected by the theft.
SAFU and company funds covered the gap
Zhao said the theft-related shortfall was covered through company funds, Binance's Secure Asset Fund for Users, known as SAFU, and a derivatives insurance fund. The exchange created SAFU as a reserve funded through a portion of trading fees, and it stood at about $1 billion before the incident.
SAFU transferred 7,499 BTC, which Binance described as roughly half of the assets held at that address. Blockchain data showed approximately 7,500 BTC remained in the SAFU address, valued in the source material at about $580 million.
Zhao said SAFU would be restored to roughly $1 billion and that Binance would absorb the losses related to the theft. The use of several funding sources gives Binance more flexibility than relying on a single reserve wallet, though it also means customers will look for clarity on how much of the replacement capital came from internal corporate funds and how insurance reserves will be rebuilt.
The incident also revived debate over public claims about exchange solvency. In an online exchange with Elon Musk, Zhao referred to SPCX stock linked to Binance's $500 million investment in Musk's acquisition of Twitter, saying the stake was worth more than $1 billion. Zhao later said he had not indicated he would sell the shares and did not intend the comment as a threat.
Trading firms reassess exposure
Some professional trading firms maintained activity on Binance while reducing operational exposure. Williams of SQS Trading said the firm kept about one-quarter of its trading capital on the exchange and planned to reduce that allocation by around one-third. The firm was not fully closing positions or ending its use of Binance for hedging, according to the supplied account.
That response captures the more measured end of the market reaction. A trading firm can continue using a venue for liquidity, derivatives positions and hedging while lowering the amount of capital held there between trades. The strategy limits dependence on a single custodian without requiring an immediate exit from markets where the exchange remains active.
The next test for Binance will be less about the initial withdrawal surge than the pace at which all affected assets and networks return to normal service. A complete proof-of-reserves report, replenishment of SAFU and sustained processing of withdrawals would give customers concrete measures of whether the exchange's recovery systems are holding after one of the largest reported hot-wallet thefts in the sector.
Concerned about CEX security after the Binance breach? Learn how proof-of-reserves can protect your exchange funds.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
