Binance recorded about $2.51 billion in net outflows from wallets tracked by DeFiLlama on Nov. 1, the day it began gradually restoring withdrawals after an Oct. 29 security incident. Bitcoin and USDT accounted for nearly $2 billion of the total. But Binance is routing subsequent withdrawals through newly generated wallets, making it difficult to determine whether customers are leaving the exchange or how much they have actually transferred out.
Bitcoin and USDT account for most tracked outflows
The tracked net outflows included about $1.083 billion in USDT, $912 million in Bitcoin, $385 million in USDC and $131 million in wrapped Ether. The movements came as withdrawal services reopened in stages. They may include a backlog of withdrawal requests as well as customers moving assets to other addresses; the available data does not distinguish between these explanations.
Binance temporarily suspended withdrawals following the security incident, which involved about $6.3 billion. The FBI attributed the attack to North Korea’s TraderTraitor hacking operation. Binance said customer funds remain secure and that the company would cover the financial losses caused by the attack.
Withdrawals return across 15 blockchain networks
In a Nov. 1 announcement, Binance said it was gradually restoring withdrawals across 15 blockchain networks after additional security checks. The first networks to reopen included Bitcoin, Ethereum, BNB Smart Chain, XRP and Base. Binance later confirmed support for Dogecoin and Optimism. The initial phase also covered Solana, Tron, Arbitrum, Avalanche, Polygon, Zcash and Sui, with individual assets becoming available as security checks were completed.
Binance co-founder He Yi said withdrawal processing was generally stable, though higher demand could cause temporary congestion before conditions returned to normal. She also urged users to verify withdrawal addresses and make sure their devices and surroundings were secure. During the phased reopening, the availability of different networks and assets may vary, affecting how quickly withdrawals are processed.
Asset replenishment does not mean funds have been recovered
Binance said it had replenished about 95% of the affected assets using company resources and market purchases, up from the 90% reported in an earlier update. The exchange said its balances of Bitcoin, Ethereum, USDT, USDC, BNB, Solana, XRP, USD1, RLUSD and Zcash were fully backed. The remaining shortfall was concentrated in less liquid tokens.
Replenishing affected assets does not mean the stolen funds have been recovered from the attackers. Binance said it continues to work with law enforcement and industry partners to trace and recover the assets. The exchange has also updated its proof-of-reserves wallet list to include newly generated addresses and said future withdrawals would be processed through those wallets. With wallet addresses and withdrawal routes changing, observed on-chain outflows alone cannot establish how much customers have transferred. Binance has committed to publishing a detailed post-incident report, while its updated proof-of-reserves information will give customers further data to check asset backing.