Binance reopened its withdrawal gates this weekend, and the market immediately voted with its feet. Tracked Binance wallets recorded approximately 2,510 million USD in net crypto outflows on November 1, according to DeFiLlama data, as customers regained access to their funds for the first time since the exchange’s 6.3 billion USD security breach. The number is startling on its face — but reading it correctly is the real analytical challenge, because Binance’s own recovery moves are tangled up inside the flow data.
What the outflow numbers show
According to DeFiLlama’s tracking of Binance wallet addresses, the November 1 net outflows broke down into roughly 1,083 million USD in USDT, 912 million USD in Bitcoin, 385 million USD in USDC and 131 million USD in wrapped Ethereum. Bitcoin and Tether together accounted for nearly 2 billion USD of the tracked total. The flows began as Binance started phasing withdrawal access back on across 15 blockchain networks, having completed what it described as additional security reviews following the October 29 attack that the FBI has attributed to North Korea’s TraderTraitor hacking operation.
The first phase restored withdrawals on Bitcoin, Ethereum, BNB Smart Chain, XRP and Base, then added Dogecoin and Optimism. Solana, Tron, Arbitrum, Avalanche, Polygon, Zcash and Sui were also included in the initial phase, with individual assets becoming available as their security checks completed.
The catch in the data
Here is why the headline number deserves caution rather than panic: Binance is restoring withdrawals through entirely new wallets. The exchange updated its proof-of-reserves wallet address list on November 1 to include newly generated addresses that will process all subsequent withdrawals. That means on-chain trackers watching the old, known wallet set are observing a transitional picture — flows that mix genuine customer exits with the mechanical consequences of an exchange rebuilding its treasury plumbing.
Binance says customer funds remain protected and that it will absorb the financial losses from the attack itself. The exchange reported it has replenished about 95 percent of the affected assets through corporate resources and market purchases, up from 90 percent in its previous update. Balances in Bitcoin, Ethereum, USDT, USDC, BNB, Solana, XRP, USD1, RLUSD and Zcash are fully backed, according to the company, with the remaining unreplenished portion consisting primarily of less-liquid tokens. It is worth stressing what that does not mean: replacing stolen assets out of corporate coffers is not the same as recovering them from the attackers, and investigations with law enforcement and industry partners continue.
Signs of a functioning — if strained — recovery
Binance co-founder Yi He said on X that withdrawal processing was proceeding without significant disruption, while cautioning that a surge in requests could cause temporary congestion before smoothing out again. She urged customers to verify withdrawal addresses and confirm their devices and operating environments are secure before moving funds — standard advice, but pointed in a week when the industry has watched suspected compromised hardware and malicious software extensions make headlines.
From a market-structure standpoint, the reopening itself is arguably the more important signal. The speed of restoration — withdrawals phased back across 15 networks within roughly three days of the breach — suggests the exchange’s recovery playbook functioned under extreme stress. The last comparable industry event, the FTX collapse in 2022, offered no withdrawal path at all. The contrast matters for how traders price exchange risk going forward.
How to interpret the flows from here
For everyday investors, three practical readings emerge. First, treat the 2.5 billion USD figure as a ceiling on panic, not a measure of it. Some unknown share of those flows reflects the wallet migration itself, and DeFiLlama’s own presentation of the data comes with the same caveat about newly generated wallets. Second, watch where the outflows land. If the USDT and Bitcoin leaving Binance largely reappear on other centralized exchanges, this is rotation among venues. If it stays on self-custody addresses or flows into decentralized venues, that reflects a genuine trust shift — one that would echo the decentralized-exchange thesis several analysts have advanced since the hack.
Third, Binance’s credibility now rests on its promised deliverables. The exchange has pledged a detailed post-incident investigation report, and its updated proof-of-reserves disclosures are expected to reveal more about the assets backing customer balances. Those documents, more than any single day of on-chain flows, will determine whether the largest exchange in crypto can hold its position after the largest theft in its history.
The 6.3 billion USD breach and the freeze that followed were the shock. The next few weeks of flow data — clean flow data, once the wallet migration settles — will show whether customers forgive. In markets, trust returns faster than most expect, but slower than any exchange would like.
2.5B out in a day and over a billion of it is USDT. thats not panic, thats people quietly moving house
worth noting Binance rotated to fresh proof-of-reserves addresses on Nov 1, so trackers are mixing real exits with their own shuffling. the true exodus number is lower
exactly, fresh reserve addresses and genuine panic exits inside the same 24h window. without a cluster split that 2.5b is a range, not a number
912M in BTC gone after a 6.3B hack and ppl still call withdrawal concerns FUD? id have been out the door at hour one lol
same energy. moved everything to cold storage yesterday, took ages but it cleared. not risking round two
DeFiLlama counting internal rotations as outflows is how 2.5B becomes a headline. Wait for the labeled cluster breakdown before calling it an exodus.
2.5B out in a day, over a billion of it USDT alone, and people still keep size on CEX. self custody has a learning curve, fine, losing access for a week is worse
the learning curve argument got weaker the moment the status page went dark for a week. one weekend setting up a hardware wallet beats praying withdrawals reopen
Reopening withdrawals across 15 networks in phases was the right security call. I moved my stack out on day one of the freeze and have zero regrets after that 6.3B breach.
DeFiLlama only tracks labeled wallets, so the true exodus could be higher or lower. Treating this as a clean customer-exit metric is sloppy math.
this. half that flow is probably binance shuffling between its own hot and cold wallets and nobody could tell from the outside