Binance is reopening withdrawals in phases after the $6.3 billion theft on October 29. In the first nine and a half hours it processed $4.65 billion in withdrawals against $1.01 billion in deposits, a net outflow of about $3.64 billion. Separately, the exchange has tapped its SAFU emergency fund: the Bitcoin held in its SAFU wallet fell from roughly 15,000 BTC to about 7,500 BTC.
Outflows after withdrawals reopened
Binance said the $3.64 billion net outflow equals 2.1% of the $171 billion in assets in its October 28 reserve report. After an initial spike, it said withdrawal volumes declined and were stabilizing. The first phase covered 15 networks and assets, including Bitcoin, Ethereum, BNB Smart Chain, XRP, Solana and Tron. The exchange has since added Zcash, TON and Sui, and restored fiat withdrawals in US dollars, UAE dirhams, Vietnamese dong, Philippine pesos and Indonesian rupiah.
Public wallet trackers should be read with care. Binance moved withdrawals to newly generated wallets, so on-chain data from older addresses does not cleanly show how much customers pulled out. The $3.64 billion figure is the exchange's own.
SAFU's Bitcoin halves
Binance confirmed a transfer of 7,499 BTC on Saturday tied to partly deploying SAFU to cover the losses. The disclosed SAFU wallet now holds about 7,500 BTC, worth around $583 million. Under the fund's policy, the target is $1 billion, with a top-up if its value drops below $800 million because of Bitcoin price moves, but the policy sets no deadline for refilling it after a security incident. Binance did not answer questions about replenishment.
The exchange says losses are being covered from corporate funds, SAFU and part of its futures insurance fund. It reports it has replaced about 95% of affected assets, up from 90% a day earlier, and has pledged that Binance, not users, will absorb the loss.
Reserve proof and the investigation
Binance said users can check balances against its Saturday proof-of-reserves snapshot. It shows customer holdings in 10 assets, including Bitcoin, Ether and USDT, backed at least 1:1. A wider snapshot covering more tokens is planned for Wednesday, with proof generation expected to take 40 to 50 hours.
The FBI attributes the theft to North Korea's TraderTraitor group and has published hundreds of linked addresses, asking exchanges and services to block them. Replacing customer assets does not mean the stolen funds have been recovered.
What it means for traders
Price has not reacted sharply. Bitcoin trades near $77,900, down 0.4% since midnight UTC, and Ether near $2,286, up 0.5%. ETF flows were heavier: US spot Bitcoin ETFs lost $643 million on Friday, their largest one-day outflow since June 25.
In derivatives, futures volume reached $111.8 billion, up 56% in 24 hours, while open interest was little changed at $137.1 billion. Liquidations were about $140.2 million, up 77%. Funding for BTC and ETH stays positive, meaning longs are paying shorts. Flat open interest with rising volume points to positions changing hands rather than new leverage piling in.
Items to watch: the updated reserve report Binance promised, Wednesday's wider reserve snapshot, ETF flows over the coming sessions, and whether SAFU is refilled. For leveraged traders, the risk is sudden volatility around news from the largest exchange; position size and custody are personal decisions. The tools page and the exchange rankings can help size risk and compare platforms.