Binance Withdrawals Resume After Hack as $3.6B Leaves Exchange

About $3.64 billion. That is how much more crypto left Binance than arrived in the first nine and a half hours after Binance withdrawals reopened on Sunday, according to The Block, which cited figures the exchange posted on X. It was the first chance customers had to move money out since hackers drained roughly $6.3 billion from the exchange's hot wallets on Thursday, October 29.

Binance says the rush is easing and that customers will not pay for the theft. Here is what the reopening covers, what the FBI says about who did it, and what you should check before you hit the withdraw button.

Can I withdraw from Binance right now?

Partly. Binance's Recovery Update #4 set phase one for November 1 between 06:00 and 09:00 UTC. The exchange said it picked the first group of tokens using the past week of user demand, and that other networks "will be added once they are ready."

Phase one covers 15 networks:

• Bitcoin (BTC), XRP, Dogecoin, Zcash and Sui on their own chains
• Ethereum (ETH, USDT, USDC), plus Arbitrum, Base and Optimism versions of ETH and stablecoins
• BNB Smart Chain (BNB, USDT, USDC) and Tron (TRX, USDT)
• Solana (SOL, USDT, USDC), Polygon (POL, USDT, USDC) and Avalanche C chain (AVAX, USDT, USDC)
• TON (USDT and GRAM)

The Block reported that all 15 were live by 7:36 a.m. Eastern. Most of the exchange's listings are still frozen, though. As of late Sunday morning, Binance's network status page showed withdrawals suspended for 531 of 552 coins, The Block said, with Cardano, Chainlink, Litecoin and NEAR among those still in testing.

How much money has left the exchange since Sunday?

Between 1 a.m. and 10:30 a.m. Eastern, Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits, per The Block. The net outflow of about $3.64 billion equals 2.1% of the $171 billion in assets Binance held in its October 28 proof of reserves data.

Outside trackers saw a similar picture. DefiLlama counted $4.05 billion in net outflows over 24 hours, and CoinGlass showed Binance's bitcoin balance down about 19,289 BTC over the same period. Binance described the early volume as an initial spike that was stabilizing, and said deposits stayed substantial.

For an exchange that just suffered the largest crypto theft on record, a 2% drain in the first hours is notable but not a bank run. The real test comes as the other 500 plus coins come back online.

Who stole the money, according to the FBI?

On Saturday, October 31, the FBI attributed the attack to TraderTraitor, a North Korean hacking group, CoinDesk reported. The bureau, joined by the Secret Service and IRS Criminal Investigation, asked node operators, instant swap services, DeFi platforms and analytics firms to block transactions linked to addresses the group is using to launder the funds. CoinDesk said the FBI's list included more than 600 Ethereum addresses, just under 20 bitcoin addresses and one Solana address.

The attackers have mostly converted the loot to ETH, according to CoinDesk, and stablecoin issuers have frozen more than $2.4 billion of the stolen funds. Chainalysis CEO Jonathan Levin told CoinDesk the group has already used thousands of addresses and expects that to grow to tens of thousands in the coming weeks. It has been a rough fortnight for crypto security in general; the DeFi DNS hijack hit users of several apps just days earlier.

Will Binance customers lose money?

Binance says no. Its November 1 update states that the exchange "will bear the financial impact of the stolen funds" and that losses will not be passed to users.

The company set aside more than $6.34 billion of its own money after the breach. By October 31 it said it had replenished about 90% of the stolen assets, using part of its SAFU emergency fund, part of its futures insurance fund and its corporate treasury. On November 1 it raised that figure to about 95%. The remaining 5% sits in tokens outside its top ten, which Binance described as less liquid.

Binance also says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed. It has committed to refilling SAFU to about $1 billion.

When will Binance prove it has the reserves?

A new proof of reserves snapshot was taken at 00:00 UTC on October 31. Binance says the full zero knowledge proof takes 40 to 50 hours to generate and expects it by Tuesday, November 3 (UTC). Once it is out, you can check that your own balance is included on the proof of reserves page. The company has also promised a post incident report once its investigation ends.

What should Binance users do this week?

1. Check the asset and network before withdrawing. Only phase one networks are open, and sending on an unsupported chain can strand funds.
2. Expect delays. Binance warns of longer processing times and says to retry after a short while if a withdrawal fails.
3. Ignore anyone offering to "speed up" or "recover" your withdrawal. Big incidents attract scammers who pose as support staff, and Binance posts updates only through its official channels.
4. If you are moving funds to a bank, follow the steps in our guide to cashing out crypto to a bank account and send a small test first.
5. Review our earlier breakdown of what Binance users should do after the hack, which covers 2FA and API key checks that still apply.

Deposits were never paused, so nothing changes if you are only buying. If you are deciding where to keep coins long term, the Chainalysis breach is a reminder that even security firms leak data, and a hardware wallet you control removes one layer of risk. More coverage lives on our crypto page.

The number to watch now is Tuesday's proof of reserves. If it shows full backing across the top ten coins, the outflows may stay at a trickle.