In one hour on Sunday, Binance customers withdrew $1.24 billion. By the final hour of the exchange’s 46-hour tally, customers were putting slightly more money in than they were taking out. Between those two moments, Binance processed $10.97 billion in withdrawals as it reopened access to funds after the October 29 hack.
Customers also deposited about $5.70 billion during that stretch, leaving $5.28 billion in net outflows, according to figures Binance released November 3. Those withdrawals were customers moving their own money. The $6.34 billion Binance says attackers took on October 29 is a separate loss. Blockster’s original coverage of the breach
Post from @binanceView the original post on X↗
The rush was heaviest just after withdrawals reopened
Binance’s chart runs from 06:00 UTC on November 1 to 04:00 UTC on November 3. Two hours into that window, customers withdrew $1.24 billion and deposited $307 million. That left a $936 million gap in a single hour.
By the last hour shown, the direction had flipped. Binance recorded $193 million in deposits and $183 million in withdrawals, a $10 million net inflow. That hour helps explain why co-CEO Richard Teng described flows as stabilizing. Across the full period, customers had still taken out roughly $3 for every $100 Binance reported holding before the reopening.
What customers could actually move
The exchange restored withdrawals in stages, by token and network. In a November 3 update, Binance listed 34 more assets on Ethereum and 22 on Solana. The Ethereum list included Chainlink’s LINK and Ondo’s ONDO. The Solana list included Jupiter’s JUP and BONK. For a customer waiting to move a particular token, the relevant update was the one naming both the asset and its network.
Post from @binanceView the original post on X↗
Why pausing withdrawals took only part of the pressure off
In its initial incident report, Binance said attackers gained access to an internal service that authorizes wallet transactions. Some permissions had already been recorded on the blockchain. Pausing customer withdrawals stopped requests coming through the exchange, but the attackers could still use those permissions until Binance revoked them.
Binance said it had set aside enough of its own funds to cover the loss and was buying the outstanding tokens that were harder to source. It also said about $2.85 billion had been frozen or intercepted. That figure counts assets whose movement was blocked. It does not establish how much Binance has recovered.
“Binance will absorb the financial impact of the stolen funds, not our users.”
— Binance, November 3 initial incident report
Those commitments answer one question for customers: who covers the shortfall? The phased reopening answers another: when can a customer actually move a balance? As Blockster reported in its coverage of CertiK’s reserve checks, verifying what an exchange holds and testing how it restores withdrawals after a breach are two different jobs.
Reporting by Sasha Steenkamp
