Binance is experiencing billions of dollars in net asset outflows after reopening withdrawals following its $6.3 billion security breach, providing an early measure of how users are repositioning after the largest publicly documented crypto theft. DefiLlama currently shows approximately $7.03 billion in 24-hour net outflows from Binance-attributed wallets, up from an earlier $5.8 billion reading as the rolling measurement window continued to move. The tracker simultaneously lists about $127.9 billion in assets across wallets it attributes to the exchange.
Those figures should be distinguished from Binance’s own accounting. In an official withdrawal update, the exchange said it processed $4.649 billion of withdrawals and $1.01 billion of deposits between 06:00 and 15:30 UTC on November 1, producing $3.64 billion in net outflows during the first 9.5 hours of restored service. Binance compared that amount with $171 billion in assets reported through its October 28 Proof of Reserves, putting the initial net withdrawal at roughly 2.1% of that separate balance measure.
Withdrawal Access Returns Across 15 Networks
Binance began restoring withdrawals at 06:00 UTC on November 1 and had activated all 15 networks included in its first phase by 12:36 UTC. Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Zcash, Dogecoin, TON, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism and Sui were included, although only specified assets were initially supported on each network. The reopening was therefore substantial but did not represent full restoration of every Binance asset and network at once.
The distinction between exchange-reported and blockchain-tracked flows is especially important as the numbers evolve. DefiLlama measures movements involving publicly identified exchange wallets, while Binance can observe customer deposits and withdrawals through its internal accounting. Different windows and wallet coverage can produce materially different net-flow estimates without either figure necessarily contradicting the other. The same principle applies to exchange balances generally: an onchain transfer does not by itself establish whether funds moved into self-custody, another exchange or another destination.
Other venues have simultaneously recorded inflows. DefiLlama currently shows approximately $445.6 million in 24-hour net inflows for OKX, alongside smaller positive readings for Bybit, Gate and Bitget. Those concurrent flows do not prove that assets leaving Binance moved directly to those exchanges, because the tracker does not establish a one-to-one relationship between Binance withdrawals and deposits elsewhere.
Binance Replenishes 95% as FBI Attributes Attack
The withdrawal wave follows the October 29 breach in which approximately $6.3 billion was removed from Binance-controlled infrastructure. The exchange’s preliminary investigation pointed to a compromised DevOps laptop that may have enabled access to a service container and unauthorized withdrawal requests, while finding no evidence that wallet private keys leaked. Around $3 billion of the stolen assets had subsequently been frozen onchain. The incident and its containment are detailed in the earlier $6.3 billion Binance hack and asset-freeze breakdown. Frozen attacker assets remain separate from funds Binance itself has sourced to restore backing.
By November 1, Binance said it had procured approximately 95% of the affected assets through its corporate treasury, a partial deployment of SAFU and part of its futures insurance fund. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were reported as fully backed, while less-liquid affected tokens accounted for the remaining 5%. Replenishment means replacing assets lost from Binance’s holdings; it should not be conflated with recovering the stolen property from the attacker.
The attribution has also advanced. On October 31, the FBI formally attributed the Binance theft to North Korea’s TraderTraitor activity and published attacker-linked Ethereum addresses while asking infrastructure providers to block associated laundering flows. That follows a longer history of North Korea-linked crypto laundering activity. The Binance case now has a government attribution rather than only private-sector assessments from blockchain intelligence firms.
The outflow data nevertheless remains a moving snapshot rather than evidence by itself of insolvency or a sustained loss of customer confidence. The more useful indicators will be whether withdrawals continue at elevated levels after the initial reopening, whether Binance completes asset replenishment and whether subsequent Proof of Reserves data confirms continued backing of customer balances.
