Binance Sees $3.64 Billion in Net Withdrawals as Services Resume After $6.3 Billion Hack

November 2, 2026 MM Crypto Team

Customers of Binance withdrew a net $3.64 billion as the exchange resumed services after a $6.3 billion hack, according to Reuters reporting on November 2, 2026. Binance said withdrawals were stabilising, and that it had covered about 95 percent of the stolen assets using company funds, the Secure Asset Fund for Users and the Futures Insurance Fund. It also said it expected to publish proof of reserves on November 3. The headline number, the stabilisation claim and the promised disclosure will each be tested in the days ahead.

What net withdrawals actually measure

A net withdrawal is withdrawals minus deposits over the same period. It is not the total amount customers took out. If customers withdrew a large sum but also deposited a large sum, the net figure would be small, and the story would be one of routine churn rather than flight. A large net figure means money leaving the platform substantially exceeded money coming in. Analysts therefore treat net flows as a confidence gauge. Gross withdrawals alone can mislead, because a functioning exchange always sees large sums moving in both directions as traders reposition. The net number strips out that two-way traffic and leaves the directional signal.

Why the pace of withdrawals matters

The pace matters as much as the total. An exchange must honour withdrawal requests promptly and in full, in the right assets, at all hours. When withdrawals arrive in an orderly stream, even a large one, the platform can process them from liquid holdings and replenished assets. When they arrive all at once, the strain grows quickly even if the platform is solvent in the long run. Queues lengthen, support teams are overwhelmed, and rumours fill any information gap. Binance’s statement that withdrawals were stabilising therefore carries real weight. Stabilisation does not mean withdrawals have stopped. It means the rate of leaving has eased from its initial peak, usually the first sign that the most urgent movers have already acted.

How Binance says it covered the losses

Before services resumed, Binance had said roughly 90 percent of the stolen cryptocurrency had been replenished. The later statement that about 95 percent of affected assets had been covered suggests further progress, but the two statements are not identical. Replenishing stolen coins describes replacing the missing assets themselves, while covering affected assets can include a broader set of resources used to make customers whole. Binance named three sources: company funds, the Secure Asset Fund for Users, known as SAFU, and the Futures Insurance Fund. SAFU is an emergency reserve funded by a share of trading fees, created precisely for situations in which customer funds are at risk. The Futures Insurance Fund backstops losses in the futures market so profitable traders are not forced to absorb the losses of liquidated positions. Drawing on both underlines how large the shortfall was.

A phased restart, and why exchanges use one

Withdrawals restarted in phases from November 1, rather than all at once. A phased restart lets an exchange test its systems under real load before opening every channel, spreads the operational burden across hours or days, and gives it a chance to spot problems early, when only a subset of users is affected. For customers in a later phase, however, it can feel like a delay, and delays during a crisis understandably raise questions about whether a deeper problem exists. The tension between safety and speed is unavoidable. Move too fast and a system fault can compound the original crisis. Move too slowly and customers reasonably ask what is being held back. That Binance could report stabilising withdrawals after the phased restart suggests the reopening proceeded without a second visible failure.

Why customers leave, and where the money goes

Not every withdrawal signals a permanent loss of faith. Some customers leave because they want to hold assets in wallets they control directly while the situation clarifies. Others move funds to a different exchange, spreading risk rather than abandoning centralised trading. Still others withdraw only a portion, keeping a trading balance on the platform while moving the bulk of their holdings to cold storage. All of those behaviours appear in the same net figure, which is why the number alone cannot tell the full story. Broader market data on November 2 showed a mixed picture rather than a simple flight from crypto. Bitcoin traded around $78,418, up about 1 percent over 24 hours, while Ether stood at about $2,292, up about 1.18 percent, according to CoinGecko and exchange spot data. That suggests at least some money leaving Binance was redeployed elsewhere in crypto, rather than converted entirely to cash.

The wider market backdrop

The hack did not happen in a calm market. United States spot Bitcoin exchange-traded funds recorded a $643.2 million outflow on the Friday before the November 2 reporting, erasing several sessions of inflows. Institutional flows of that size reflect decisions by fund managers acting for many investors at once, and they can amplify price moves in either direction. When fund outflows coincide with an exchange security crisis, the two stories reinforce each other in traders’ minds even when their causes differ. Bitcoin recovered to about $78,455 on November 2, gaining about 1.11 percent over 24 hours, while remaining lower over seven days. Commentators pointed to resistance near $78,500 and support near $77,500, levels that are shorthand for where buyers and sellers have recently met in size, not predictions or investment advice.

What proof of reserves can and cannot prove

Binance’s expected proof of reserves publication on November 3 will be the next major test. Proof of reserves is a method by which an exchange demonstrates that it holds assets corresponding to customer balances, typically using cryptographic techniques that let customers verify their individual balance was included in a larger total, without revealing every other customer’s holdings. The exchange usually also discloses wallet addresses it controls, so independent observers can check on-chain balances. Done well, this gives customers reason to believe the assets backing their accounts actually exist at a particular point in time. Its limits are equally important. A proof of reserves is a snapshot, not a continuous guarantee, and it does not prove solvency on its own, because solvency requires comparing assets with liabilities. A disclosure showing assets without a matching, verifiable statement of liabilities is incomplete. Analysts will look for which assets are included, how they are valued, whether liabilities are disclosed, and whether an independent party verified the figures.

Why this matters beyond one exchange

The episode matters beyond Binance because of the exchange’s size and centrality across spot trading, derivatives, custody and payments. A security failure there raises questions that apply to the whole centralised exchange model: how are hot wallets, the internet-connected wallets used for day-to-day withdrawals, protected? What permissions do automated systems hold over those wallets? How quickly can an exchange detect an intrusion, freeze affected systems and communicate honestly? Every other exchange will face those questions from customers and regulators, and the answers will shape the next round of security standards, including how much customer crypto should sit in hot wallets and how emergency funds are sized and disclosed. A hack of this size also strengthens the case for stricter rules on segregation of customer assets, independent audits and insurance disclosure, and for self-custody, where users hold their own private keys.

Practical lessons for ordinary users

For ordinary users, the practical lessons are less dramatic but more durable. Keeping only a trading balance on an exchange and moving long-term holdings to a wallet whose keys you control reduces exposure to any single platform failure. Using strong, unique credentials and hardware-based two-factor authentication reduces the risk of account compromise, a separate threat from an exchange-wide breach. Verifying withdrawal addresses carefully, and being sceptical of urgent messages arriving during a crisis, protects against the phishing campaigns that reliably follow high-profile hacks. None of these steps would have prevented the Binance breach, which was a failure of the platform’s own systems, but they determine how much an individual customer loses when a platform fails. The coming days will test whether stabilisation is durable: the detail of the November 3 reserves disclosure, whether net outflows keep slowing, and whether fund inflows and prices recover. The market will judge the rest on evidence, not reassurance.

Frequently asked questions

What does a net withdrawal of $3.64 billion mean?

It means that, over the period measured, the total value customers withdrew from Binance exceeded the total value they deposited by $3.64 billion. It measures the net direction of customer funds, not the gross amount withdrawn, and it is used as a gauge of confidence in the platform.

Why did Binance restart withdrawals in phases?

A phased restart lets an exchange test its systems under real load, spread the operational burden, and catch problems early while only a subset of users is affected. It can feel slow to customers waiting for a later phase, but it reduces the risk of a second failure during recovery.

What is the Secure Asset Fund for Users?

The Secure Asset Fund for Users, known as SAFU, is an emergency reserve funded by a share of trading fees and set aside to protect customers in extraordinary situations, such as a major security breach. Binance said it drew on SAFU, company funds and the Futures Insurance Fund to cover affected assets.

Does proof of reserves guarantee that an exchange is safe?

No. Proof of reserves can show that an exchange held certain assets at a particular moment and let individual customers verify that their balance was included. It does not, on its own, prove solvency, because solvency also requires a full and verifiable statement of liabilities, and it does not guarantee holdings will remain unchanged afterwards.

Should customers keep all their crypto on an exchange?

Many experienced users keep only a trading balance on an exchange and move long-term holdings to a wallet they control directly. That reduces exposure to any single platform’s failure, although self-custody brings its own responsibilities, including safeguarding private keys and recovery phrases.

Source: Reuters

MM Crypto Analysis Web