Binance Faces $4.7 Billion in Net Withdrawals After Record Crypto Theft — A Test of Trust for the World's Largest Exchange

The theft of more than $6 billion in cryptocurrency has entered a new phase. Binance says it has replaced or covered 95% of the stolen assets, but customers have withdrawn billions since services began reopening. The exchange now faces a challenge that cannot be resolved simply by replacing stolen tokens: restoring confidence in the security of the platform.

The cryptocurrency exchange Binance is facing a major test of customer confidence after processing approximately $3.64 billion in net withdrawals during the first nine and a half hours following the reopening of withdrawal services on November 1.

The withdrawals followed a security breach on October 29 in which attackers stole cryptocurrency valued at approximately $6.3 billion, according to Binance, in what is believed to be the largest cryptocurrency theft ever recorded.

Binance says it has already replaced or otherwise covered approximately 95% of the affected assets and has committed to absorbing the financial losses rather than passing them on to customers.

Nevertheless, the reopening of withdrawals has revealed a second challenge.

The immediate security emergency is being addressed, but substantial amounts of customer money are moving away from the exchange.

The figures do not establish how many customers have permanently abandoned Binance. Some may simply be transferring cryptocurrency into private wallets or moving assets temporarily while awaiting further information.

They do, however, demonstrate the scale of the financial movement following the breach.

For an exchange that has built its business around providing customers with convenient access to digital assets, the question is no longer only how the theft occurred.

It is whether Binance can convince customers that their money remains safe.

November 2: Binance Publishes New Reserve Verification as Withdrawals Reach $4.72 Billion

Binance has completed a new verification of customer-asset reserves following the record $6.3 billion cryptocurrency theft, marking an important development in the exchange's effort to restore confidence.

The verification covers ten major cryptocurrencies, including Bitcoin, Ether, BNB, Solana, XRP and several stablecoins. Binance says customers holding these assets can independently check that their balances are backed by reserves at a ratio of one to one.

The development comes as net customer withdrawals have reached approximately $4.72 billion since services began reopening on November 1, according to figures reported by Reuters.

That represents approximately 3% of assets held on the platform, based on Binance's estimates.

Although the amount is substantial, the exchange says the initial surge in withdrawals has begun to moderate. Binance has also reported approximately $2.7 billion in customer deposits since Sunday.

The figures present a more complicated picture than an uncontrolled flight of customer funds.

Customers have withdrawn billions of dollars, but Binance continues to process transactions, attract deposits and replenish the assets affected by the breach.

What the new reserves report establishes

The verification uses zero-knowledge cryptographic technology, designed to allow customers to check that their balances are included in the exchange's reserve calculations without exposing private account information.

It provides a degree of transparency that was not available immediately after the attack.

However, a Proof of Reserves verification is not equivalent to a complete independent financial audit.

It does not necessarily establish every corporate liability, financial obligation or operational risk facing the exchange.

Binance says approximately 95% of the stolen assets have now been replaced or otherwise covered, with the remaining portion consisting largely of less-liquid cryptocurrencies.

A further reserves snapshot is planned for Wednesday, November 4.

The stolen cryptocurrency remains a separate problem

Replacing customer assets does not mean the stolen cryptocurrency has been recovered.

Blockchain investigators continue tracing funds associated with the attack. Elliptic estimates that attackers still control approximately $3.24 billion in cryptocurrency, primarily Bitcoin and Ether.

Stablecoin issuers have frozen substantial amounts of stolen assets, including more than $1.1 billion in USDC frozen by Circle.

However, frozen assets are not automatically recovered assets, and the investigation remains active.

Confidence has been shaken, but the wider market remains functioning

The scale of the withdrawals demonstrates the concern created by the security breach.

Nevertheless, analysts have reported limited evidence of wider financial contagion or a disorderly collapse in cryptocurrency markets.

Binance's ability to replace affected assets, restore withdrawals and publish new reserve verification distinguishes the current situation from previous cryptocurrency failures involving insufficient customer backing.

That does not eliminate the seriousness of the attack.

The exchange must still demonstrate that the vulnerabilities exploited by the attackers have been addressed and that customers can continue accessing their assets without further disruption.

Additional withdrawal services are expected to resume on Tuesday, November 3.

The next important tests will be the restoration of full customer access, the additional reserves snapshot on November 4 and the publication of Binance's detailed technical investigation.

For now, the evidence points to an exchange under significant pressure, but one that is continuing to operate and taking measurable steps to restore customer confidence.

Billions leave Binance as withdrawals resume

Binance began restoring cryptocurrency withdrawals in phases on Sunday, November 1, after suspending them following the attack.

According to figures released by the exchange and reported by The Block, customers withdrew approximately $4.65 billion between 1:00 a.m. and 10:30 a.m. Eastern Time.

During the same period, deposits amounted to approximately $1.01 billion.

The difference produced net outflows of approximately $3.64 billion.

Binance said the amount represented around 2.1% of the $171 billion in assets reflected in its latest reported reserves data.

The exchange also said withdrawal activity had declined after the initial surge and was stabilising.

That distinction is important.

A withdrawal of billions of dollars is substantial in absolute terms, but the percentage of reported assets provides a different perspective on the immediate financial pressure.

The figures do not, by themselves, demonstrate that Binance is insolvent, unable to meet its obligations or experiencing a permanent collapse in customer demand.

They do show that a significant number of customers or large account holders have decided to move assets following the breach.

Independent blockchain tracking services have reported additional outflow estimates, although these are not necessarily directly comparable with Binance's figures.

Some transfers visible on public blockchains may involve internal wallet movements rather than customers removing funds from the platform.

For that reason, figures from different sources must be assessed according to what they actually measure.

The central fact remains: billions of dollars in cryptocurrency have moved out of Binance since withdrawals began reopening.

The attack that triggered the crisis

The events began on October 29, when Binance disclosed that attackers had compromised its internet-connected cryptocurrency wallets.

These wallets, commonly known as hot wallets, are used by exchanges to process transactions quickly.

Unlike cold wallets, which are generally kept offline, hot wallets remain connected to operational systems and are therefore more accessible to both authorised users and potential attackers.

Binance estimated the value of the stolen assets at approximately $6.3 billion.

Blockchain analytics company Elliptic placed the figure at approximately $6.43 billion.

The difference reflects variations in asset valuation and the methods used to identify transactions associated with the attack.

Either estimate makes the incident considerably larger than the February 2025 attack on Bybit, in which approximately $1.46 billion was stolen.

The Binance attack affected assets across multiple blockchain networks.

Elliptic identified activity involving 11 networks, including Ethereum, Bitcoin, Solana and others.

A large proportion of the stolen cryptocurrency was transferred within a short period, demonstrating how quickly attackers can move funds once critical transaction infrastructure has been compromised.

The scale of the theft was extraordinary.

But the speed with which the assets moved may prove equally important to understanding the weaknesses exploited by the attackers.

How did the attackers gain access?

The technical investigation remains incomplete.

Binance initially indicated that a compromised laptop belonging to a DevOps engineer may have played a role.

Subsequent investigations identified additional points of compromise, suggesting that the attack was more complex than the exploitation of a single employee device.

Binance has said it has not found evidence that wallet private keys were leaked.

That statement is significant but does not establish that the underlying transaction infrastructure remained secure.

Cryptocurrency transactions can potentially be manipulated through compromised software, access permissions, transaction-signing systems or other trusted components without an attacker necessarily obtaining a wallet's private key directly.

The exact mechanism used in this incident has not yet been fully established publicly.

Binance has promised a technical report explaining the sequence of events and the measures introduced to prevent similar attacks.

Until that report is available, detailed explanations of the intrusion should be treated as preliminary findings rather than settled facts.

Binance says 95% of stolen assets have been covered

Binance's financial response has developed rapidly since the breach.

On October 30, the exchange said it had set aside more than $6.34 billion in company funds to address the losses, with approximately $5 billion already held in the affected cryptocurrencies.

By October 31, it reported that around 90% of the stolen assets had been replenished.

On November 1, the company said that approximately 95% had been recovered or covered.

The remaining portion consists largely of smaller, less-liquid tokens that take longer to purchase in the required quantities. Binance says customer balances in its ten largest affected assets, including BTC, ETH, USDT, BNB, SOL and USDC, are fully backed.

Binance has said it will absorb the losses using corporate resources and its emergency protection arrangements, including the Secure Asset Fund for Users, known as SAFU.

Established in 2018, SAFU was designed to provide financial protection for users during exceptional events, including serious security incidents.

Part of the funding is also coming from its futures insurance fund and from the corporate treasury. Binance has said it intends to restore SAFU to around $1 billion.

These commitments represent a substantial financial response.

However, several different concepts must be distinguished.

Replacing stolen cryptocurrency means providing equivalent assets from another source.

Freezing stolen cryptocurrency means preventing certain assets from being transferred further.

Recovering stolen cryptocurrency means regaining control of assets that were taken.

These outcomes are not interchangeable.

An exchange can restore customer balances without recovering the original stolen funds, provided it has sufficient resources to cover the losses.

Similarly, cryptocurrency that has been frozen may remain inaccessible to the attacker without yet having been returned to its original owner.

For customers, the immediate concern is whether their balances remain fully backed and accessible.

For investigators and Binance itself, the recovery of stolen assets remains a separate challenge.

Nearly $3 billion in stolen cryptocurrency frozen

Binance has said approximately $3 billion in stolen assets have been frozen through cooperation with blockchain intelligence firms, token issuers and other industry participants.

Elliptic independently verified approximately $2.85 billion in frozen or seized assets.

Much of this amount consists of centrally issued stablecoins. Tether froze about $1.57 billion in USDT and Circle more than $800 million in USDC, according to Elliptic's figures.

Stablecoins are cryptocurrencies designed to maintain a relatively stable value, commonly by reference to the US dollar.

Certain stablecoin issuers have the technical ability to prevent specific addresses from transferring their tokens.

This can be an important tool when stolen funds are identified quickly.

However, the same mechanism does not exist for every cryptocurrency.

Native Bitcoin and Ether, for example, cannot simply be frozen by a central issuer.

Elliptic estimated that about $3.2 billion of the stolen funds was held in assets that cannot be frozen in this way.

This creates a continuing contest between investigators attempting to trace and secure stolen funds and attackers seeking to move them beyond the reach of recovery efforts.

Even when transactions are visible on public blockchains, identifying the destination of stolen assets does not guarantee that they can be recovered.

Is Binance losing customers or simply experiencing precautionary withdrawals?

The question of customer confidence is now central to the story.

A cryptocurrency exchange can experience substantial withdrawals for several reasons.

Customers may fear further security problems.

They may want direct control of their cryptocurrency rather than relying on a third-party platform.

Institutional investors may move assets temporarily while conducting internal risk assessments.

Some traders may transfer holdings to competing exchanges or decentralised platforms.

Others may withdraw funds simply because services have become available again after a period of suspension.

These decisions can produce large financial outflows without necessarily representing permanent customer departures.

Binance has not provided verified figures demonstrating how many individual customers have closed their accounts or permanently stopped using the platform as a result of the incident.

That information would be necessary before concluding that the exchange is experiencing a lasting decline in its customer base.

Nevertheless, the withdrawal figures are an important indicator of customer behaviour.

Confidence in a financial platform is not measured only by the amount of money it holds.

It is also reflected in customers' willingness to leave assets there when they have the opportunity to move them elsewhere.

Why this matters beyond Binance

The incident raises broader questions about the structure of the cryptocurrency industry.

Traditional financial institutions operate within regulatory systems that may include capital requirements, supervisory oversight, customer-asset protections and deposit insurance arrangements.

Cryptocurrency exchanges operate under different legal and regulatory frameworks depending on the jurisdiction.

The protections available to customers can vary substantially.

A customer holding cryptocurrency on an exchange is generally dependent on the exchange's systems to process withdrawals and maintain access to assets.

That relationship differs from holding cryptocurrency in a private wallet controlled directly by the customer.

Self-custody removes certain exchange-related risks but introduces others, including the possibility of losing private keys or falling victim to scams without a practical recovery mechanism.

Neither arrangement is free from risk.

The Binance incident illustrates why understanding custody arrangements is essential for cryptocurrency users.

It also raises questions for regulators about how major exchanges should demonstrate that they can withstand extreme security incidents.

An exchange handling enormous quantities of digital assets must protect its technical infrastructure while maintaining sufficient financial resources to respond if those protections fail.

The Binance case provides an unusually large real-world test of both responsibilities.

The lessons of previous cryptocurrency failures

The cryptocurrency industry has experienced several major crises involving exchanges, security breaches and customer funds.

Some incidents have resulted primarily in direct financial losses from theft.

Others have exposed deeper problems involving inadequate reserves, poor governance or misuse of customer assets.

The collapse of FTX in 2022 demonstrated how quickly confidence in a major cryptocurrency platform can disappear when serious financial and governance problems emerge.

However, the Binance situation should not be presented as equivalent to FTX without evidence.

Binance says it has sufficient resources to replace the stolen assets and has begun restoring withdrawals.

Those are material differences.

The comparison is useful primarily because it demonstrates the importance of transparency, access to customer funds and credible evidence supporting financial claims.

A major security breach does not automatically mean an exchange is insolvent.

But uncertainty following a breach can create pressure that extends beyond the immediate financial loss.

For Binance, the challenge is to show that its systems are secure, customer assets remain adequately backed and the company can continue operating normally.

The financial consequences remain uncertain

The immediate value of the theft does not necessarily represent Binance's final financial loss.

Some stolen assets have been frozen.

Others may eventually be recovered.

Binance has also committed substantial corporate resources to replacing the missing cryptocurrencies.

The final cost will depend on the value of recovered assets, the amount required to complete replenishment, changes in cryptocurrency prices and additional expenses associated with the incident.

There may also be indirect costs.

Security upgrades, investigations, legal expenses and potential regulatory scrutiny can impose significant financial burdens.

More difficult to measure is the commercial impact of lost customer confidence.

An exchange may be able to replace stolen assets relatively quickly.

Rebuilding trust can take considerably longer.

Whether the current withdrawals become a temporary disruption or a sustained reduction in customer activity will only become clear with additional data.

What happens next?

Several developments will determine how the Binance story evolves.

The first is the continuing restoration of withdrawal services.

Binance began reopening withdrawals on November 1, but not every asset was immediately available. By mid-morning Eastern Time, all 15 networks in the first phase had reopened, but withdrawals remained suspended for most of the more than 550 coins listed on the exchange.

The pace at which full access is restored will be important for customers seeking reassurance that normal operations have resumed.

The second is the next reserve snapshot, planned for 4 November, and whether the remaining 5% of affected assets is replenished.

Each new verification will show whether the exchange's claims about customer-asset backing continue to be supported by published cryptographic proof.

The third is the investigation into the security breach.

Binance has promised a technical explanation, while law enforcement and blockchain intelligence firms continue tracing stolen assets.

Finally, the exchange's customer flows will need to be monitored beyond the initial reopening period.

A single day of large withdrawals can demonstrate immediate concern.

A sustained pattern over several days or weeks would provide stronger evidence of a lasting change in customer confidence.

A test that money alone cannot resolve

The October 29 theft was extraordinary in scale.

Binance's commitment to covering billions of dollars in losses is also extraordinary.

But the events of November 1 show why the financial response is only part of the story.

Customers have begun moving substantial amounts of cryptocurrency away from the platform, even as Binance reports major progress in replacing stolen assets.

That does not prove the exchange is facing insolvency or an irreversible loss of customers.

It does establish that the company must now address questions extending beyond the original security failure.

The next phase will be measured through verifiable reserves, restored withdrawal access, transparent technical findings and the behaviour of customers over time.

Binance may be able to replace the stolen cryptocurrency. Whether it can restore the confidence shaken by the attack remains an open question.

Sources

• The Block — Binance sees $3.64 billion in net outflows after reopening withdrawals, 1 November 2026 – Withdrawals of $4.65 billion and deposits of $1.01 billion between 1:00 and 10:30 a.m. ET, the 2.1% share of $171 billion in assets, the stabilising outflows, the reopened networks and the projected date of the new Proof of Reserves report.
• CoinCentral — Binance reopens withdrawals, says 95% of stolen crypto replaced, 1 November 2026 – The 95% replenishment figure, the ten fully backed assets, the use of SAFU and the futures insurance fund, and the Proof of Reserves timetable.
• Trending Topics — Binance after the theft: withdrawals resume, 95 percent covered, 1 November 2026 – The funding sources for the $6.34 billion commitment, SAFU's history and size, and the less-liquid tokens still being replaced.
• NFT Evening — Binance hit by record $6.3B theft as partners freeze about $3B, October 2026 – The roughly $3 billion frozen with industry partners, Elliptic's verified $2.84–2.85 billion, and the Tether and Circle freezes.
• Elliptic — analysis of the Binance theft, October 2026 – Valuation of approximately $6.43 billion, the 11 blockchains involved, the frozen or seized total, and about $3.2 billion held in assets that cannot be frozen.
• Decrypt — Binance finds "additional points of breach", 30 October 2026 – The compromised DevOps engineer's laptop, the additional points of breach, the statement that no private-key leak was found, and the planned technical report.
• CoinDesk — Binance arranges $6.34 billion to cover losses, 30 October 2026 – Binance's $6.34 billion commitment and the approximately $5 billion already held in the affected assets.
• The Defiant — Binance says 90% of stolen assets replenished, targets Nov. 1 restart, 31 October 2026 – The 90% replenishment figure on 31 October and the planned 1 November restart of withdrawals.
• The Block — Binance completes latest proof of reserves as it works to restore assets, withdrawals, 2 November 2026 – The zero-knowledge verification of ten assets, the 95% replenishment, the 4 November snapshot and the 3 November withdrawal restart.
• Reuters (via The Korea Times) — Binance clients pull $4.7 billion after hack as crypto world studies fallout, 2 November 2026 – The $4.72 billion net withdrawals, about 3% of platform assets, $2.7 billion in inflows since Sunday, Elliptic’s $3.24 billion estimate, Circle’s USDC freeze and analysts on contagion.

Reporting note: This is a developing story, updated on 1 November 2026. Figures are those reported by Binance, The Block and independent blockchain analytics firms and may be revised; valuations of stolen cryptocurrency vary with the method and time of measurement. Withdrawal figures are not presented as proof of permanent customer departures or of financial difficulty. Binance has not published a full technical account of the breach, and this report does not speculate on who was responsible. Editorial update, 2 November 2026: This article has been updated to reflect Binance's latest Proof of Reserves verification, the increase in reported net customer withdrawals to $4.72 billion, the company's continuing asset-replenishment efforts and new information about the recovery of stolen cryptocurrency. The reserve verification provides additional transparency but should not be interpreted as a comprehensive financial audit. Customer withdrawals also do not, by themselves, establish insolvency or permanent customer departures.

Tips, corrections or questions: ritstjorn@frettir247.news

More from Business

BUSINESS · ECONOMYIceland's Strong Króna: Economic Strength or a Growing Competitiveness Problem?31 October 2026BUSINESS · ECONOMYIceland's Economy at a Crossroads: What the IMF Sees Ahead31 October 2026BUSINESS · INDUSTRYIceland's Next Economic Chapter: Building New Industries Beyond Tourism and Fisheries31 October 2026