About $2B Leaves Binance Within 3 Hours of Withdrawals Reopening
Roughly $2 billion in BTC, USDT, USDC and ETH left Binance within about three hours of withdrawals reopening on Nov. 1. Binance says payouts now come from new proof-of-reserves wallets but has not matched the transfers, leaving open whether it was customers or internal reshuffling.
Binance reopened the doors on Sunday, and roughly $2 billion in bitcoin, ether and stablecoins walked straight out. Whale Alert flagged the outflows within about three hours of the first withdrawal window, which ran from 06:00 to 09:00 UTC on Nov. 1.
The tape: 10,000 BTC (about $779 million), nearly $1 billion in USDT, $200 million in USDC and 30,000 ETH ($68 million), each tagged as going to an "unknown wallet."
Here is the catch. Binance says every withdrawal is now paid from newly generated addresses added to its proof-of-reserves list, but it has not publicly matched these transfers to those wallets. Until it does, nobody outside the exchange can say whether this was customers pulling funds or Binance reshuffling its own.
The $6.3 billion hack behind all this is laid out in our earlier coverage. As we reported on the reopening, phase one put the Bitcoin network first, alongside assets on 15 other blockchains, with networks prioritized by the past week of user demand. Binance announced it on X:
"First batch network now opened in phase one of withdrawals is $BTC bitcoin network"
Binance, via X
Analytics firms have tied the exploit to TraderTraitor, a North Korean-linked entity, and the FBI has blamed North Korean operatives. Bitcoin sat near $78,000, and the Sunday rally some had predicted had not shown up.
Put the BTC leg next to the theft. TRM Labs counts 18,270 BTC (about $1.47 billion) among the stolen assets, so the 10,000 BTC that left in three hours is more than half that figure. Binance says about 95% of affected assets are replaced from company funds, including its Secure Asset Fund for Users, up from 90% a day earlier. The rest are less liquid tokens outside the top ten, still being bought through market and OTC channels.
A Binance spokesperson framed the reopening as a milestone, not a finish line:
"Resuming withdrawals is a major milestone, but our work continues."
Binance spokesperson
What traders should watch
The risk is in the details. Binance warned of congestion, longer processing times and temporary delays, and further reopenings hinge on each chain passing security and stability checks. About $3 billion of stolen funds is currently immobilized, mostly USDT and USDC that issuers can block. BTC and ETH cannot be frozen that way.
Binance has also drawn on its insurance fund, the reserve that absorbs losses from bankrupt futures positions. The exchange says it moved only excess funds, but published balances give traders just a partial view of what protection remains.
Binance maintains that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are 100% backed and that users will not bear the loss. The full proof-of-reserves result, which Binance had targeted for Nov. 2-3, is the next test of that claim, and the first chance to see whether those new wallets line up with Sunday's outflows.
