Binance Reports $3.64B Outflow After Withdrawals Reopen

Binance withdrawals exceed deposits after reopening

The exchange’s official news account reported $4.649 billion in withdrawals against $1.01 billion in deposits between 06:00 and 15:30 UTC November 1. It put the net outflow at 2.1% of $171 billion in assets under management, using October 28 reserves data.

Binance said withdrawals eased after an initial surge while deposits remained substantial. That is the company’s assessment of the flow pattern, rather than independent evidence that customer confidence has recovered.

All 15 networks in the first phase were restored by 12:36 UTC, according to the same account. The next phase remained under testing. A completed first phase therefore does not establish universal availability for every coin or network.

The original recovery announcement lists specific asset and network combinations. A stablecoin available on one blockchain may still be unavailable on another, so transfer access depends on the route as well as the asset.

Net withdrawals also leave the destination unresolved. Customers can move assets to another exchange, a custodian or a self-controlled wallet without selling them. An exchange outflow alone cannot establish an equivalent exit from cryptocurrency markets.

Competing Binance flow totals need reconciliation

The Block reported that DefiLlama showed $4.05 billion in net outflows over 24 hours as of 11:37 a.m. ET November 1. That dashboard tracked $131.1 billion across Binance wallets, a different asset base from the company’s figure.

The same report said the next 10 largest exchanges tracked by DefiLlama received about $368 million in combined net inflows. It noted that the provider does not track Coinbase or Kraken. That limited comparison cannot identify where every withdrawn dollar went.

Reuters subsequently reported a higher $5.81 billion dashboard reading. A Binance spokesperson disputed the earlier external calculation, saying it did not include funds deposited into the exchange’s new hot wallets.

The figures should not be added together or treated as interchangeable. Different measurement windows, address coverage and internal wallet transfers can change an apparent exchange flow. Daily Crypto Briefs has not independently reconciled the competing totals.

The Block said Binance was processing withdrawals through newly generated wallets added to its reserves list. It reported that an updated proof-of-reserves report, based on an October 31 snapshot, was projected for Monday, November 2. That is a company timetable, not confirmation that the report has been published.

The practical question is whether the new addresses are identified consistently across the company’s disclosures and external trackers. A dated snapshot can help establish backing at one point in time; it cannot describe every transfer that follows.

Binance theft, frozen funds and replacements differ

The loss-impact check for this article, completed at 08:05 UTC November 2, found confirmed theft evidence. TRM Labs traced approximately $6.36 billion from Binance wallets to attacker-controlled addresses, valuing transfers when stolen. Its initial findings were timestamped October 30 at 00:30 UTC.

TRM identified ordinary signed transfers across multiple chains and an Ethereum wallet delegation used to sweep assets. That evidence concerns compromised exchange infrastructure, rather than establishing that individual customers separately disclosed their wallet keys.

Elliptic’s November 1, 08:00 UTC update estimated $6.43 billion stolen and verified $2.85 billion frozen or seized. Its tracking distinguished theft-time valuation from current-price freeze measurements. These are attributed estimates with different cutoffs, not a new loss added to Binance’s own roughly $6.3 billion assessment.

The reviewed sources did not establish a verified count of affected customer accounts. Attacker-address counts should not be substituted for customer-victim counts.

The FBI’s October 31 notice attributed the theft to North Korean activity it calls TraderTraitor. Investigators observed conversion primarily into ETH and urged service providers to block transactions tied to listed addresses.

Reuters reported that Binance had used its own money to replace about 95% of the stolen assets, with less liquid tokens still being sourced. As explained in the earlier reserve replacement coverage, purchases to restore backing do not establish recovery from the attackers. Frozen assets likewise have not necessarily been returned.

Alternative.me’s Bitcoin Fear & Greed Index read 37, or Fear, on November 2, compared with 34 previously. It is a broad sentiment gauge, not a survey of Binance customers.

The next disclosures to watch are the reserves report, additional withdrawal routes and a reconciliation of external wallet-flow estimates. The company-reported outflow establishes substantial use of reopened services; the reviewed data does not settle the longer-term customer response.