Nearly $3.8 Billion Withdrawn From Binance Within 10 Hours of Reopening, Figure Circulating From Kalshi Post

Since attackers drained about $6.3 billion from Binance hot wallets on Oct. 29 and the exchange froze withdrawals, the story has moved from the theft to the aftermath. Today, Nov. 1, Binance began a phased restart of withdrawals, and customers headed for the exits.

Nearly $3.8 billion left the exchange in roughly 10 hours, according to a figure posted on X by prediction market Kalshi. Binance had not published its own outflow number at the time of writing.

Big assets first, big outflows fast

Binance reopened withdrawals for its largest assets first: Bitcoin, Ethereum, USDT, USDC and BNB. Deposits stayed open throughout the freeze, the exchange said.

The outflow is large in absolute terms. It is also a fraction of the theft itself, and Binance has not said what share of customer balances it represents.

The exchange has said it replenished about 95% of the affected assets, drawing on its Secure Asset Fund for Users (SAFU), futures insurance and corporate treasury. Co-CEO Richard Teng's line to customers: "your money is safe, and we're covering every loss."

The analysis site 24/7 Wall St. read the withdrawals differently. It argued that outflows at that pace signal a meaningful segment of users choosing to pull funds rather than wait, and that such exits can feed on themselves as more people watch the queue and join it. That is the site's reading, not an established trend. No source ties the withdrawals to any move in bitcoin's price.

Where the stolen money is

On-chain tracing from Bitquery shows how the theft unfolded. Between 20:04 and 23:56 UTC on Oct. 29, 17 Binance hot wallets on nine chains were emptied. Other analysts count the chains differently: TRM Labs says ten, Elliptic says 11.

The total also varies by who is counting. Binance says $6.3 billion. Chainalysis estimates about $5.9 billion at the time of the theft. Elliptic tracked $6.43 billion.

Stablecoin issuers did most of the freezing. Tether froze more than $1.567 billion in USDT, and Circle CEO Jeremy Allaire said his company froze more than $800 million in USDC. Bitquery puts the total locked, including by Arbitrum's Security Council and four smaller issuers, at $2.7 billion. Elliptic verified about $2.84 billion frozen as of 12:55 UTC on Oct. 30. Binance has said roughly $3 billion.

Not everything could be locked. Bitcoin, Ether, XRP and other native assets have no issuer able to blacklist an address. Bitquery says $729 million of stolen USDT moved before Tether's freezes landed. Elliptic puts the stablecoins swapped for ETH or TRX at about $786 million, some of it at prices 12% to 26% below market, which Elliptic reads as the attacker prioritizing speed.

As of 16:51 UTC on Oct. 31, Bitquery found about $3.1 billion still with the attacker, including 525,201 ETH. The attacker took 200,630 ETH directly and bought the rest with stolen stablecoins, tokens and TRX. Bitquery found none of it sent to an exchange deposit address or a mixer.

How the attackers got in

Binance's initial statement pointed to a compromised DevOps engineer's laptop, which gave an attacker access to a service container to submit unauthorized withdrawals. The exchange said it found no evidence of a wallet private key leak.

That explanation has been qualified. Teng said the attack was "not a single one-click action" and involved a more complex process, and that the investigation has not attributed responsibility to any individual. Binance later said the investigation identified additional access points beyond the initial hypothesis.

TRM Labs concluded that the infrastructure Binance uses to sign hot wallet transactions was compromised, the only way the attackers could get transactions of their choosing signed. TRM also says the attack was prepared the day before, funded in small amounts through Tornado Cash.

On Ethereum, Elliptic says the attacker used pre-signed authorization orders to hand control of a hot wallet to a smart contract. That points to Binance's approval or signing layer rather than a single stolen key.

Attribution and accountability

The FBI and blockchain analytics firms have linked the attack to TraderTraitor, a North Korean hacking group, according to Crypto Briefing's account. The same group was tied to the roughly $1.5 billion Bybit theft in February 2025. No charges have been announced in the Binance case.

Binance co-founder Changpeng Zhao, who pleaded guilty in 2023 to failing to maintain an effective anti-money laundering program and served four months in prison, said on Oct. 29 that he no longer manages the exchange but remains a shareholder. "User funds are safe," he wrote. President Donald Trump pardoned him last year.

What comes next

Binance has promised a detailed technical post-mortem once its investigation is complete and an updated Proof of Reserves once remediation is finished. It has given no date for either. Those two documents will show whether customer assets are fully backed after a $6.3 billion hole, and how attackers got through the exchange's signing system.