Binance processed a net $3.64 billion in customer withdrawals in the first 9.5 hours after it resumed phased withdrawals on November 1, equal to roughly 2.1% of its pre-hack asset base of about $171 billion. The exchange confirmed the figure and said the initial spike later stabilized, while DefiLlama and other trackers showed elevated flows in the broader 24-hour window.

The outflows followed the suspension of withdrawals after the October 29 theft of approximately $6.3–$6.4 billion across roughly 10–11 blockchains, executed in about 20 minutes. Binance has stated it covered roughly 95% of the losses with more than $6.34 billion drawn from its treasury, SAFU fund, and futures insurance fund, affirming that users will not bear the cost. The remaining portion involves less-liquid tokens expected to take longer to source.

On October 31–November 1, the FBI formally attributed the attack to TraderTraitor, the North Korean state-sponsored unit previously linked to the 2025 Bybit theft. The bureau said more than $6 billion in virtual assets were stolen on or about October 29 and that the actors were converting funds primarily into Ethereum while preparing further laundering. TRM Labs, Chainalysis, and Elliptic had earlier reached the same conclusion with high confidence, citing on-chain patterns and commingling with prior North Korea-linked proceeds. Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop as a likely entry point.

The incident also triggered institutional caution. U.S. spot Bitcoin ETFs recorded approximately $643 million in net outflows on Friday, October 30—the largest single-day outflow in four months—while Ethereum ETFs saw significant redemptions, with some reports near $400 million. The flows erased a multi-day inflow streak. Bitcoin nonetheless showed relative resilience, recovering to the mid-$78,000s by the CoinMarketCap November 1 snapshot of $78,248.45, with dominance remaining near 60%.

Industry observers noted that the contained percentage outflow and rapid loss coverage suggest greater market maturity relative to earlier exchange failures, though the confirmed state-sponsored nature of the attack has intensified calls for tighter hot-wallet controls and stronger cooperation on address blacklisting. Market participants continue to watch midterm election results and any further Binance operational updates.