Binance Customers Withdraw $3.64 Billion After Hack, but Exchange Says Outflows Are Stabilizing

Binance customers withdrew a net $3.64 billion in cryptocurrency after the exchange began restoring withdrawal services following its record $6.3 billion security breach. However, Binance says withdrawal activity is slowing and customer deposits remain substantial.

The figures, offer an early indication of how cryptocurrency users responded to one of the biggest security incidents in financial history.

The reported net outflows amounted to approximately 2.1% of Binance’s assets, based on the exchange’s reported asset holdings.

The withdrawals followed Binance’s decision to reopen selected cryptocurrency networks on November 1.

Binance says it has replenished around 95% of the assets affected by the attack and will cover the financial impact using company resources.

But does the withdrawal activity suggest that users are losing confidence in Binance, or is the exchange showing signs of recovery?

What Happened After Binance Resumed Withdrawals?

On November 1, Binance began restoring withdrawal services after temporarily suspending them during an investigation into its October 29 security breach.

According to Binance’s official recovery announcement, the exchange prioritized popular cryptocurrencies and blockchain networks, including Bitcoin, Ethereum, BNB, Solana, XRP, and selected stablecoins.

The services were restored gradually, rather than all at once.

After withdrawals reopened, customers began moving significant amounts of cryptocurrency away from the platform.

Binance said the activity represented around 2.1% of its assets.

The exchange also said the initial surge was declining and that deposits continued at substantial levels.

These statements suggest that not every customer was attempting to leave the platform.

However, withdrawal activity alone cannot establish how much confidence users have in Binance.

What Does $3.64 Billion in Net Outflows Mean?

A net outflow is the difference between money or assets leaving a platform and those entering it.

For example, suppose customers withdraw $5 billion in cryptocurrency while other customers deposit $1.5 billion.

The net outflow would be $3.5 billion.

This is different from saying that only $3.5 billion was withdrawn.

In the Binance case, the $3.64 billion figure represents estimated net outflows during the reporting period.

It does not represent the amount stolen by hackers.

It also does not necessarily represent permanent losses to Binance.

Customers who withdraw funds may be transferring their cryptocurrency to personal wallets, other exchanges, or institutional custody services.

How much of Binance’s assets does this represent?

Binance reported approximately $171 billion in assets under management as of October 28.

Using that figure, $3.64 billion represents roughly 2.1%.

Although $3.64 billion is an enormous amount, it is a relatively small proportion of the exchange’s reported total assets.

However, the percentage alone does not prove that Binance has sufficient liquidity for every possible withdrawal scenario.

That requires additional information about the exchange’s actual asset holdings, liabilities, and operational arrangements.

Why Are Different Companies Reporting Different Withdrawal Figures?

Not every blockchain analytics company measures exchange flows in exactly the same way.

For example, DefiLlama reported higher outflow estimates than Binance acknowledged.

Binance argued that some calculations included transfers between wallets controlled by the exchange itself.

This distinction matters.

Cryptocurrency exchanges routinely move assets between internal wallets for security, liquidity management, and operational reasons.

If an analytics system incorrectly counts those transfers as customer withdrawals, the estimated outflow may be exaggerated.

On the other hand, independent blockchain analytics can provide useful information that helps verify what exchanges report.

The difference highlights the importance of understanding the methodology behind cryptocurrency flow statistics.

A large transfer from an exchange-controlled address is not necessarily evidence that a customer withdrew funds.

For the most accurate interpretation, analysts need to distinguish customer withdrawals from internal wallet movements and other operational transactions.

What Happened During the $6.3 Billion Binance Hack?

The withdrawals followed a security incident that Binance says began on October 29, 2026.

In its October 30 security update, Binance estimated the total impact at approximately $6.3 billion.

Its initial investigation suggested that attackers may have compromised a DevOps engineer’s laptop.

The device may have provided unauthorized access to internal infrastructure used for processing cryptocurrency withdrawals.

However, Binance’s later investigation identified additional possible breach points.

The full technical explanation has not yet been published.

Binance says it found no evidence that its wallet private keys were leaked.

Following the incident, the exchange temporarily suspended withdrawals, revoked affected authorizations, and worked with industry partners to freeze stolen assets.

It reported that approximately $3 billion had been frozen on-chain.

The frozen funds have not necessarily been returned to Binance.

Has Binance Recovered the Stolen Cryptocurrency?

Binance says it has replenished approximately 95% of affected assets.

However, replenishing assets is different from recovering stolen cryptocurrency.

If hackers steal Bitcoin from an exchange, the exchange may use its corporate treasury to purchase replacement Bitcoin.

That can help restore the reserves backing customer balances even if the original stolen coins remain under the attackers’ control.

According to Binance, it has purchased replacement assets through cryptocurrency markets and over-the-counter trading.

The company says the remaining affected assets are less-liquid tokens that may take longer to replace.

It has also promised to absorb the financial losses rather than pass them to customers.

These are company commitments, and their full financial implications will become clearer as Binance provides additional verified information.

Is Binance Experiencing a Bank Run?

A bank run occurs when many customers withdraw funds from a financial institution because they fear they may not be able to access their money later.

Cryptocurrency exchanges are not identical to traditional banks, but similar confidence-related withdrawal pressures can occur.

The Binance incident created conditions in which some customers might reasonably want to reduce their exposure to exchange custody.

However, the initial $3.64 billion net outflow does not, by itself, establish that Binance is experiencing an uncontrolled run.

The exchange says withdrawals are stabilizing and deposits remain substantial.

Reuters also reported that analysts considered the outflow proportion relatively modest compared with Binance’s reported assets.

This does not prove the exchange is free from financial or operational risk.

It means the available data does not support treating the initial withdrawals as proof of insolvency.

What Should Binance Users Watch Next?

Several developments will help clarify Binance’s recovery.

Withdrawal availability: Whether additional cryptocurrencies and blockchain networks become available without major disruptions.

Asset replenishment: Whether Binance completes the remaining portion of its replacement programme.

Proof of Reserves: Whether the company publishes sufficiently detailed information about the backing of customer assets.

Security investigation: Whether the promised technical report explains how attackers obtained unauthorized access.

Customer activity: Whether deposits and withdrawals return to ordinary operating patterns over a longer period.

A few hours of transaction activity cannot establish the long-term condition of the exchange.

Frequently Asked Questions

How much did Binance users withdraw after the hack?

Reuters reported approximately $3.64 billion in net outflows during an initial nine-and-a-half-hour period after withdrawals resumed.

Is the $3.64 billion part of the stolen $6.3 billion?

No. The $3.64 billion refers to customer net withdrawals following the reopening of services. The $6.3 billion refers to the estimated cryptocurrency stolen during the security breach.

Is Binance going bankrupt?

The available withdrawal figures do not establish that Binance is insolvent. Binance says it has replenished approximately 95% of affected assets and that withdrawals are stabilizing.

Did Binance recover 95% of the stolen cryptocurrency?

Not necessarily. Binance says it replenished 95% of affected assets, including by purchasing replacement tokens using company resources.

Are Binance withdrawals working again?

Binance began restoring selected cryptocurrency withdrawals on November 1, 2026. Availability depends on the cryptocurrency and blockchain network.

Why do blockchain analysts report different withdrawal numbers?

Analytics platforms may use different wallet classifications and methods for distinguishing customer withdrawals from internal transfers.

Key Takeaways

• Binance experienced approximately $3.64 billion in reported net customer outflows after restoring withdrawals.
• The figure represented about 2.1% of Binance’s reported assets.
• Binance says withdrawal activity is stabilizing.
• The company says it has replenished 95% of the assets affected by the $6.3 billion hack.
• Replenishment is not the same as recovering stolen cryptocurrency.
• The investigation and restoration of normal operations remain ongoing.