Binance’s tracked cryptocurrency wallets recorded $2,510 million in net outflows on Nov. 1 after the exchange resumed withdrawals following its $6.3 billion security breach.

According to DeFiLlama data, the outflows included approximately $1,083 million in USDT, $912 million in Bitcoin, $385 million in USDC and $131 million in wrapped Ethereum.

These outflows coincided with Binance’s phased reopening of withdrawal services after the Oct. 29 attack, which the FBI attributed to North Korea’s TraderTraitor hacking operation.

Binance restores withdrawals as executives warn of possible congestion

In a Nov. 1 announcement, Binance said it was gradually restoring withdrawal access across 15 blockchain networks after completing additional security reviews.

The exchange initially reopened withdrawals for Bitcoin, Ethereum, BNB Smart Chain, XRP and Base, then confirmed support for Dogecoin and Optimism.

Other supported networks in the first phase include Solana, Tron, Arbitrum, Avalanche, Polygon, Zcash and Sui, with individual assets becoming available as security checks are completed.

Binance co-founder Yi He said withdrawal processing was proceeding without significant disruption, although increased demand could temporarily affect transaction processing. She wrote on X:

“Things are currently running fairly smoothly. If there are many withdrawal requests, congestion cannot be ruled out, after which it will smooth out again.”

He also urged customers to verify withdrawal addresses and ensure their devices and operating environments were secure before transferring funds.

Meanwhile, Binance has updated its proof-of-reserves wallet address list to include newly generated wallets, which it said would process all subsequent withdrawals.

The infrastructure changes followed the multibillion-dollar breach that forced Binance to temporarily suspend withdrawals while investigators examined its compromised hot-wallet systems.

Binance has maintained that customer funds remain protected and that the company will absorb the financial losses from the attack.

The exchange said it replenished about 95% of the affected assets through corporate resources and market purchases, up from 90% in its previous update.

It also reported that balances in Bitcoin, Ethereum, USDT, USDC, BNB, Solana, XRP, USD1, RLUSD and Zcash were fully backed, while the remaining unreplenished assets consisted primarily of less-liquid tokens.

However, replacing stolen assets does not mean the original funds have been recovered from the attackers. Binance continues working with law enforcement and industry partners to trace and potentially recover those assets.

The extent to which the observed on-chain outflows reflect customers moving assets elsewhere remains uncertain, particularly as Binance transitions withdrawals to newly generated wallets.

The exchange has pledged to publish a detailed post-incident investigation report, while its updated proof-of-reserves disclosures are expected to provide further information about the assets backing customer balances.