Binance reopens withdrawals on 15 networks, says $3.64 billion flowed out

Binance reopened customer withdrawals in stages early Sunday, starting with bitcoin, after halting them following the Oct. 29 attack. By 7:36 a.m. EST, withdrawals had resumed on all 15 networks in its first phase, it said [9][15]. Between 1 a.m. and 10:30 a.m. EST, Binance said, it processed $4.649 billion in withdrawals and $1.01 billion in deposits, "resulting in a net outflow of approximately $3.64 billion" [15].

For users, this is the moment the incident turns from a balance-sheet story into a practical one. Whether they can get their money out now depends on which network their coins sit on. Binance had said on Saturday that it was on track to reopen on Sunday [14], and it met that date for the largest networks.

The mechanism

A crypto exchange does not reopen withdrawals all at once. Each blockchain it supports, such as Bitcoin, Ethereum or Solana, needs its own wallet and its own payout process. Binance is reopening them one network at a time. Its first post of the night said the "first batch network now opened in phase one of withdrawals is $BTC bitcoin network" [1].

There is a second change underneath. At 1:53 a.m. EST, Binance said it had "updated our list of Proof of Reserves addresses to include newly generated wallet addresses," and that "all withdrawals will be processed from these new wallet addresses" [2]. In plain terms, payouts now come from fresh wallets rather than the ones that existed before the attack. Proof of Reserves is Binance's public list of the wallets it says hold customer assets.

The evidence

Binance posted each phase as a "Latest Withdrawal Update"; from 5:48 a.m. EST, the posts split networks into "New" and "Already Enabled." The first two posts used different wording. The 2:49 a.m. post said withdrawals "have now been restored" for Ethereum and BNB Smart Chain, and promised more "following the completion of our security checks" [3]. The table sets the phases out in order.

Source: @binance posts on X [1][3]-[9]. Times are post times in EST; U.S. clocks moved back an hour at 2 a.m. EDT, so 1:20 a.m. and 1:53 a.m. are the second, EST, occurrence of those times. Counts are Le Coin's. The 4:38 a.m. post was the first full list and included bitcoin, Ethereum and BNB Smart Chain as open.

By Le Coin's count, the 7:36 a.m. post lists 33 asset-and-network pairs as open. The two big dollar-pegged tokens are the most widely restored: by the same count, USDT is open on nine networks and USDC on eight. The phases came quickly after 4:38 a.m.: five more posts in just under three hours, adding ten networks [4]-[9]. Binance's own summary puts the start at 06:00 UTC, which is 1 a.m. EST, and the end of the first phase at 12:36 UTC, or 7:36 a.m. EST, matching the last phase post [15].

The flows

Binance then published its first numbers on what customers did once the doors opened. At 11:12 a.m. EST it said that "after an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial" [15].

Source: @binance post on X, 11:12 a.m. EST Nov. 1 [15]. Binance gives the net as "approximately $3.64 billion" and the share as 2.1%; our recomputation matches.

Binance frames the outflow against its "$171 billion in total assets under management (AUM), based on the latest available Proof of Reserves (PoR) data as of October 28, 2026" [15]. That base predates the attack. On reserves, it says a new snapshot "was taken at 00:00 UTC on October 31," which was 8 p.m. EDT on Oct. 30, and that "the updated report is expected to be available on our PoR website tomorrow," which Le Coin reads as Monday, Nov. 2 [15]. On Saturday, Binance had estimated the full proof "by Tuesday, 2026-11-03 (UTC)" [14]. Changpeng Zhao (@cz_binance), quoting the post, wrote: "Blockchain data is transparent" [16].

The reopening also follows Binance's account of its losses. At 11:04 p.m. EDT Saturday, it said: "We have already covered $6B of the impacted amount of the hacked loss" [11]. That is Binance's own measure of the losses it says it has covered, not a recovery of the coins taken.

For scale, here are CoinGecko's prices for the four largest networks' main coins at 12:09 p.m. EST [17]. They are reference points only; we draw no link to the reopening.

Source: CoinGecko [17], accessed 12:09 p.m. EST Nov. 1.

A safety warning

Reopenings draw scammers, and Binance's co-founder addressed that directly. "Binance's community rewards campaign requires regulatory approval and will go live after the regulator reviews and approves it once offices open tomorrow," Yi He wrote at 7:05 a.m. EST. "There is currently no cash voucher campaign, so please be vigilant against all types of phishing and scam links" [10]. Every phase post ends the same way, too: "Further updates will be shared through official Binance channels" [4]-[9]. That is the exchange's own guide to where real news will appear.

The objection

A reopened network is not the same as a normal service. Binance now gives totals, but not how long payouts take or whether limits apply. It says only that its team "continues testing rigorously the remaining networks and assets" and will share the next phase "as soon as we can" [15]. It does not list which networks remain closed.

The figures that do exist are Binance's own. The coverage claim [11], the phase lists [1]-[9] and the flow totals [15] come from the exchange, and its 2.1% uses a pre-attack base. We have not checked the flows on-chain.

The tell (Le Coin's view)

In Le Coin's view, the next test is the less-traded networks. Binance said on Saturday that the last 10% of its coverage "consists of tokens outside the top ten," which "are less liquid, which means they may take longer to source" [14]. If withdrawals for smaller tokens reopen on the same brisk schedule, the recovery is broad. If the list stalls at the big networks for days, those holders are the ones still waiting. Watch, too, whether Monday's reserves report arrives as promised, and whether the next flow update shows withdrawal volumes still declining, as Binance says they have.

Stop

Binance reopened withdrawals on 15 networks by 7:36 a.m. EST Sunday. It says a net $3.64 billion left by 10:30 a.m. EST, about 2.1% of its $171 billion in assets, and that more networks are still being tested. Yi He says there is no cash voucher campaign.

Sources

• [1] @binance, https://x.com/binance/status/2116777408074600621, 1:20 a.m. EST Nov. 1.
• [2] @binance, https://x.com/binance/status/2116785774540787920, 1:53 a.m. EST Nov. 1.
• [3] @binance, https://x.com/binance/status/2116799757507305516, 2:49 a.m. EST Nov. 1.
• [4] @binance, https://x.com/binance/status/2116827310229967326, 4:38 a.m. EST Nov. 1.
• [5] @binance, https://x.com/binance/status/2116833451949306221, 5:03 a.m. EST Nov. 1.
• [6] @binance, https://x.com/binance/status/2116844881448743094, 5:48 a.m. EST Nov. 1.
• [7] @binance, https://x.com/binance/status/2116851716448718901, 6:15 a.m. EST Nov. 1.
• [8] @binance, https://x.com/binance/status/2116855614634852611, 6:31 a.m. EST Nov. 1.
• [9] @binance, https://x.com/binance/status/2116871932075516174, 7:36 a.m. EST Nov. 1.
• [10] Yi He (@heyibinance), https://x.com/heyibinance/status/2116864322412720171, 7:05 a.m. EST Nov. 1.
• [11] @binance, https://x.com/binance/status/2116728061765034338, 11:04 p.m. EDT Oct. 31.
• [12] CoinGecko, https://www.coingecko.com/, prices accessed 9:12 a.m. EST Nov. 1 (superseded by [17]).
• [14] Binance, "Security Incident | Recovery Update #3," https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62, published 10:24 a.m. EDT Oct. 31.
• [15] @binance, https://x.com/binance/status/2116926305254133892, 11:12 a.m. EST Nov. 1.
• [16] Changpeng Zhao (@cz_binance), https://x.com/cz_binance/status/2116935260193915006, 11:47 a.m. EST Nov. 1.
• [17] CoinGecko, https://www.coingecko.com/, prices accessed 12:09 p.m. EST Nov. 1.
• Le Coin's earlier coverage: https://lecoin.news/markets/2026-10-31-binance-update-3-replenished/.

Holding the Corner.

Not financial advice.