Binance Net Outflows Hit $15 Billion in a Week: Where the Money Went, and What the Data Shows

Updated November 3, 2026. A news analysis built from public reports and two live dashboards we captured ourselves. It is not financial advice, and exchange-flow numbers are estimates from third-party trackers.

The short version

Four days after the biggest exchange hack ever reported, the question on every trader's mind is simple: where is the money going? The numbers moving across the screens say two things at once. Binance, still the largest exchange by a wide margin, has lost a huge amount of customer money in a week. And the neat story that rivals such as OKX and Bybit are the obvious winners is already getting more complicated than yesterday's headlines made it sound.

• Binance, 7 days: about $15.4 billion of net outflows on DefiLlama's tracker this morning, and $3.25 billion in the last 24 hours alone.
• Yesterday's headline: Cointelegraph reported on November 2 that OKX drew about $445 million in 24-hour net inflows, Bybit $112 million, Gate $91 million and Bitget $54 million, against Binance outflows above $7 billion.
• Today's tracker: OKX's 24-hour figure has flipped to a small outflow of about $79 million, and Bybit's to about $78 million out, even though OKX is still up $346 million over seven days.

How we got here: a quick timeline

• Thursday, October 29: reports describe a theft of roughly $6.3 billion from Binance, called the largest crypto hack on record. Withdrawals were frozen.
• Saturday and Sunday: Binance said it had replaced about 90% and then about 95% of the affected assets, paying from its corporate treasury, part of its SAFU fund and part of its futures insurance fund, and promised to absorb the loss rather than pass it to customers.
• Sunday, November 1: withdrawals reopened in phases, starting with 15 networks and assets.
• Monday, November 2: Binance published a zero-knowledge proof of reserves for ten assets, and trackers showed heavy net outflows.
• Tuesday, November 3: the next phase of withdrawals and a further reserve snapshot, reported for November 4, were still pending.

What the exchange dashboard shows this morning

Read the table like a weather map, not a verdict. Three things stand out:

1. The Binance number is enormous but not fatal on its face. Adding the seven-day outflow back to the $124.3 billion still tracked, Binance would have held about $139.7 billion, so the week's net outflow is roughly 11% of that figure by our own simple arithmetic. Asset prices also move these totals, so treat it as a rough guide.
2. The winners keep changing. OKX led on November 2 and has since given back some of it on the 24-hour view, though its seven- and 30-day lines remain positive. Bitfinex has the largest 24-hour inflow in this snapshot.
3. Bybit did not hold its gain. The $112 million inflow reported on November 2 sits next to a seven-day net outflow of about $64 million and a 30-day net outflow of about $151 million. A single strong day does not make a trend.

Binance's own proof of reserves

The page says account balances are verified 1:1 with a zk-SNARK mechanism and a published Merkle root. In the snapshot we saw, BTC is at 100.04%, ETH 100.00%, USDT 100.00%, BNB 101.30%, SOL 100.00%, USDC 106.08%, XRP 100.99% and USD1 100.04%. Those are Binance's own figures, and a ratio at or above 100% means the on-chain wallets cover customers' net balances for that asset at the snapshot time.

Three limits are worth remembering. The snapshot date, October 31, comes after the hack but before withdrawals reopened and customers moved funds, so it cannot describe today's position. The proof covers a set of listed assets, and The Block reports that not every supported asset is yet covered, which is why a further snapshot is planned. And a proof of reserves is not a full solvency audit, because it says little about all of a company's other obligations.

What Binance says it is doing

According to BNN Bloomberg, customers withdrew a net $4.72 billion after the reopening, about 3% of platform assets by Binance's count, mostly in USDT. Binance said it took in $2.7 billion of customer inflows over the same period and described withdrawal volumes as stabilising after an initial spike. CNBC reported net outflows of $3.64 billion in its own window. The remaining roughly 5% of affected assets are less liquid tokens that Binance says it is still buying on the market and over the counter. Separately, about $3 billion of stolen assets were reportedly frozen by industry partners, and the FBI has reportedly attributed the attack to North Korea-linked hackers.

Why the different numbers do not match

• Different windows: a rolling 24-hour figure, a seven-day figure and a “since reopening” figure answer different questions, so $7 billion, $3.25 billion, $4.72 billion and $15.4 billion are not contradictions.
• Tracked wallets only: trackers watch known exchange addresses. Funds that leave Binance may sit in self-custody, move through stablecoin issuers or arrive at wallets the tracker does not label.
• Not a transfer map: an inflow at OKX or Bybit does not mean the coins came from Binance.
• One dataset: we have not verified any of this on-chain.

Why people move money after a hack

Crashes of trust rarely follow spreadsheets. After a shock, many users pull funds first and ask questions later, because the cost of being wrong about a frozen exchange feels higher than the cost of fees and a few hours of effort. That behaviour is rational for a single person and still produces large aggregate numbers. It also explains why outflows can spike on the day withdrawals reopen and then cool, and why one exchange's gain can fade a day later when traders who parked funds temporarily move on.

What users can do sensibly

• Decide with a plan, not a headline. Write down how much you are willing to have delayed on any one exchange and keep the rest where you are comfortable.
• Test small first. If you move funds, send a small amount first and confirm the network and address.
• Check status per network. Binance restored withdrawals in phases, so a network that worked yesterday or failed today may differ from another.
• Expect fees and delays on any exchange that suddenly receives heavy deposits.
• Stay alert for phishing. Scammers use hack news to send fake “claim” or “verify” messages. Never share seed phrases or logins.
• Diversify counterparty risk. No exchange is immune, whichever name is on the door.

What to watch next

• The additional Binance reserve snapshot reported for November 4 and whether it covers all assets.
• Which networks are reopened in the next withdrawal phase, and whether tokens such as HYPE, reported as still switched off, return.
• Whether the roughly 5% of replacement assets still being bought is completed.
• Whether seven-day flows at OKX, Bybit and Bitget stay positive or reverse.
• Regulatory and law-enforcement updates, including the reported North Korea attribution.

If you are comparing exchanges

Our guides cover the exchanges in this story from the fee and feature side, not as safety ratings: Binance, Bybit, BingX and MEXC, plus Bybit vs Binance and best crypto exchanges. For the original incident write-up, see Binance $6.3 billion hack: what we know.

Disclosure: some Binance, Bybit, BingX and MEXC links in our reviews are affiliate links. Crypto trading carries a high risk of loss, and any exchange can fail or freeze withdrawals.

FAQ

Did Binance lose customer funds?

Binance says it will absorb the loss itself and that it has replaced about 95% of the affected assets. Customers have not been reported as bearing the loss, but check Binance's official statements for updates.

Is Binance still the biggest exchange?

Yes on these trackers. Binance still shows about $124 billion in tracked assets against about $29 billion at OKX.

Did OKX and Bybit gain from the hack?

On November 2 they showed 24-hour net inflows, but by November 3 their 24-hour numbers had turned slightly negative, and Bybit's seven-day figure is a net outflow. The pattern is mixed.

What is a proof of reserves?

A cryptographic check that an exchange's on-chain holdings cover its customers' recorded balances for listed assets at a point in time. It does not prove full solvency.

Should I move my funds?

That depends on your own risk tolerance. This article is not advice. Use the checklist above and only official channels.

Sources and method

• Cointelegraph, November 2, 2026
• BNN Bloomberg, November 2, 2026
• CNBC, November 2, 2026
• The Block, November 2, 2026
• DefiLlama exchange reserves (live data, our screenshot)
• Binance Proof of Reserves page (our screenshot)

Method: we read the public reports above, captured the DefiLlama table and Binance's proof-of-reserves page ourselves on November 3, 2026, and did our own arithmetic where stated. Live numbers change by the minute.