Binance Faces $3.64 Billion Net Outflows After Breach

Binance reported $3.64 billion in net outflows after withdrawals resumed on Sunday, November 1, following a reported $6.3 billion security breach. That figure comes from $4.65 billion in withdrawals and $1.01 billion in deposits. People moved a lot of money. They also left a lot of money on the platform. What happened to the stolen assets, and what Binance can demonstrate about its reserves afterward, remain the questions behind both decisions.

Binance says it has replenished 90% of the stolen assets. Its founder says 98% of customers chose to stay. Those figures can coexist with heavy withdrawals because they measure different things: claimed replacement of assets, customers counted, and dollars leaving the exchange. Put them together as a single confidence score and the math starts doing tricks.

For anyone using Binance to buy or hold crypto, the immediate concern is practical. Can you access your assets when you want to? Beyond that sits a harder question: can the exchange show how the loss was covered without asking customers to take its word for it?

What the Withdrawal Figures Show

The reopening gave customers the option to move funds after withdrawals had been interrupted. Binance resumed withdrawals following the breach, and its reported withdrawal total exceeded deposits by $3.64 billion. That is a substantial response to uncertainty, even if every dollar withdrawn had another explanation. Some customers may simply have wanted their funds elsewhere after access returned; others may have been reassessing the risk of keeping assets on an exchange that had just suffered a breach.

Net outflows describe movement over a period. They do not state how much Binance held before withdrawals reopened, how much it held afterward, or how much of the departing money belonged to customers who closed their accounts. A customer can withdraw most of a balance and keep an account open. Another can leave a small balance untouched while deciding what to do next. Neither action produces a neat vote of confidence or no confidence.

The same caution applies to the founder’s 98% customer-retention claim. It counts customers, rather than the value of assets they kept on Binance. Imagine 100 customers, two of whom hold a large share of everyone’s funds. If those two withdraw while the other 98 stay, the customer count sounds reassuring while the cash-flow chart tells a more anxious story. That example illustrates how the measures work; it is not a breakdown of Binance’s customers.

Nor does a large outflow, by itself, show that an exchange cannot meet withdrawals. The more useful test is whether customers can continue to withdraw as requested and whether Binance can account for the assets and obligations left behind. One day of movement can reveal a change in behavior. A complete balance-sheet picture requires more.

What Does “Replenished” Mean Here?

Binance’s strongest argument is straightforward: it says it moved to cover the overwhelming majority of a huge reported loss, then reopened withdrawals despite the likelihood that customers would take money out. That sequence gives people something more concrete than a promise to restore access later. If the 90% figure refers to the full reported $6.3 billion at the same valuation, it represents about $5.67 billion; the remaining 10% would be about $630 million. Those are calculations from Binance’s claim, not a verified accounting of customer balances.

The word replenished needs a ledger behind it. Binance’s CEO has said 90% of stolen assets were replenished. Customers need to know what that means in practice: which assets were lost, which assets now back customer claims, how they were valued, and whether any portion of the reported coverage depends on funds that have been frozen but not recovered.

Binance has also said roughly $3 billion in crypto was frozen after the breach. As the earlier crypto freeze raised, stopping transfers can help contain losses, but frozen assets and repaid customers occupy separate lines in the story. A freeze may prevent a thief from moving funds; it does not, on its own, put those funds back in a customer’s account. Likewise, replacement assets could cover a customer’s claim even while stolen funds remain beyond the exchange’s control. Counting each bucket separately would make the 90% claim easier to assess.

For a customer, the unit of account is not just a dollar headline. Crypto prices move, and different tokens have different uses. Someone who held a particular asset will want to know whether the same asset is available, whether its value is being calculated at a particular point in time, and whether withdrawals work as expected. A large aggregate percentage can hide those account-level questions without being mathematically wrong.

The Next Test is Verifiable Detail

A security breach creates two problems for an exchange. One is repairing the loss. The other is explaining how the attacker got in and what has changed so it cannot happen the same way again. A customer deciding whether to stay has to weigh both. Assets may be covered today while a weakness remains unresolved; a security fix can also arrive before the financial accounting is complete.

That makes an external review valuable if it addresses the actual customer questions. A useful accounting would separate the reported stolen assets, frozen assets, replacement assets and customer liabilities, with clear dates and valuation methods. A security assessment would identify the cause and the controls put in place afterward. The public claims about coverage and retention cannot substitute for those details.

There are reasons some customers may choose to wait rather than rush out. Moving crypto can involve transaction costs and operational risks, including sending an asset to the wrong address or using the wrong network. Trading needs, convenience and familiarity also count. Staying on Binance can be a considered choice, just as withdrawing can be. Neither choice tells an outsider exactly what that customer thinks of the company’s finances.

The $3.64 billion net outflow is therefore best read as a large, measurable reaction at the moment customers regained an option. Binance’s 90% coverage claim and its founder’s 98% retention claim describe different aspects of the same event, each from the company’s perspective. The next figures customers need are less catchy: an asset-by-asset accounting of the loss and its replacement, and independent scrutiny of how the breach happened. Those are the numbers that could turn an assurance into something customers can check.