# Binance Customers Withdrew Nearly $11 Billion in 46 Hours After the Hack

> Deposits offset about half the withdrawals. Binance’s figures show how quickly customers moved funds when withdrawals reopened, and when that rush began to ease.

By Sasha Steenkamp · November 3, 2026

Canonical: https://blockster.com/binance-withdrawals-11-billion-46-hours-after-hack

In one hour on Sunday, Binance customers withdrew **$1.24 billion**. By the final hour of the exchange’s 46-hour tally, customers were putting slightly more money in than they were taking out. Between those two moments, Binance processed **$10.97 billion in withdrawals** as it reopened access to funds after the October 29 hack.

Customers also deposited about **$5.70 billion** during that stretch, leaving **$5.28 billion in net outflows**, according to figures Binance released November 3. Those withdrawals were customers moving their own money. The **$6.34 billion** Binance says attackers took on October 29 is a separate loss. [Blockster’s original coverage of the breach](https://blockster.com/binance-6-3-billion-hack-crypto-security-musk)

[Post from @binance on X](https://twitter.com/binance/status/2117494793446298084)

## The rush was heaviest just after withdrawals reopened

Binance’s chart runs from **06:00 UTC on November 1 to 04:00 UTC on November 3**. Two hours into that window, customers withdrew $1.24 billion and deposited $307 million. That left a $936 million gap in a single hour.

By the last hour shown, the direction had flipped. Binance recorded **$193 million in deposits and $183 million in withdrawals**, a $10 million net inflow. That hour helps explain why co-CEO Richard Teng described flows as stabilizing. Across the full period, customers had still taken out roughly **$3 for every $100** Binance reported holding before the reopening.

## What customers could actually move

The exchange restored withdrawals in stages, by token and network. In a November 3 update, Binance listed **34 more assets on Ethereum and 22 on Solana**. The Ethereum list included Chainlink’s LINK and Ondo’s ONDO. The Solana list included Jupiter’s JUP and BONK. For a customer waiting to move a particular token, the relevant update was the one naming both the asset and its network.

[Post from @binance on X](https://twitter.com/binance/status/2117514123089231963)

## Why pausing withdrawals took only part of the pressure off

In its [initial incident report](https://www.binance.com/en/blog/community/3229153443759566763), Binance said attackers gained access to an internal service that authorizes wallet transactions. Some permissions had already been recorded on the blockchain. Pausing customer withdrawals stopped requests coming through the exchange, but the attackers could still use those permissions until Binance revoked them.

Binance said it had set aside enough of its own funds to cover the loss and was buying the outstanding tokens that were harder to source. It also said about **$2.85 billion** had been frozen or intercepted. That figure counts assets whose movement was blocked. It does not establish how much Binance has recovered.

> “Binance will absorb the financial impact of the stolen funds, not our users.”
>
> — Binance, November 3 initial incident report

Those commitments answer one question for customers: who covers the shortfall? The phased reopening answers another: when can a customer actually move a balance? As Blockster reported in its [coverage of CertiK’s reserve checks](https://blockster.com/certik-uae-crypto-losses-gate-dubai-hub71), verifying what an exchange holds and testing how it restores withdrawals after a breach are two different jobs.