Binance Hack, Day Five: $3.6B Leaves, Prosecutors Named, and the Laundering Moves

At 12:36 UTC on Sunday 1 November 2026, Binance posted the last three names on its list: Zcash, TON and Sui. With them, customers could once again withdraw on all 15 networks in the first phase of the reopening, three days after the biggest crypto theft on record. Twelve minutes later Eowyn Chen, who helps Binance with its communications, wrote: "We saw the initial volume high and the sharp downtrend, stabilizing."

At 16:12 UTC Binance published the first hard numbers. "Between 06:00 and 15:30 UTC on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion," it said. Binance puts that at 2.1% of the $171 billion it holds for customers, a figure from its own reserves count dated 28 October, the day before the theft.

The theft began at about 20:05 UTC on Thursday 29 October, when Binance's hot wallets, the internet-connected accounts it pays withdrawals from, were emptied across 10 blockchains. Binance puts the loss at about $6.3 billion. Day one traced the break-in to an engineer's hacked laptop, day two brought $6.34 billion set aside to repay customers, day three a promise of "full responsibility", and day four the FBI naming North Korea's TraderTraitor hackers as the doors began to reopen. Binance says it has now covered about 95% of the stolen value with its own money.

The bank run test

A bank run is what happens when customers fear a bank cannot pay and all ask for their money at once. A crypto exchange works like a broker that holds its clients' coins, so the test after a theft is simple: can it pay everyone who asks? FTX could not. It stopped withdrawals in November 2022 and never reopened.

Net outflow is money out minus money in, the same sum a fund manager reports as net redemptions. Binance paid out $4.649 billion in nine and a half hours and took in $1.01 billion, leaving $3.64 billion. "After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial," Binance said.

Changpeng Zhao, Binance's founder and former chief executive, put it his way at 18:02 UTC: "12 hours after withdrawals resumed: 2.1% net outflow, with most occurring in the first couple of hours. Over $1 billion in flow, too. 98% choose to stay!" The 98% is his reading of the 2.1% money figure. Binance has not said how many customers withdrew. Eowyn Chen thanked "those $1B transferring in for your trust and support."

Why a tracker shows more

At 00:30 UTC on Monday the news site Cointelegraph reported a bigger number: "$5.8B in net outflows in 24 hours", according to DefiLlama, a free public site that tracks money held in known blockchain wallets.

The two figures measure different things. Binance's covers nine and a half hours; DefiLlama's covers a full day. Binance counts customer withdrawals against customer deposits. DefiLlama watches coins leaving Binance's public wallets, and that can include Binance moving its own money, such as filling the new hot wallets it built after the theft. Cointelegraph's weekly newsletter said the $5.8 billion may include such internal transfers. No outsider has checked either figure.

Where the money went is less clear. Cointelegraph, citing a data provider it did not name, said the next 10 exchanges together gained only about $368 million, and that "Nearly 9 in 10 dollars leaving Binance didn't land on a rival exchange." The largest withdrawals were USDT and USDC, the two biggest stablecoins (digital dollars), followed by bitcoin, according to Binance's early data.

The independent check is Proof of Reserves, a public count of whether Binance holds what it owes, which uses a zero-knowledge proof, a mathematical receipt that lets each customer confirm their balance was counted without seeing anyone else's. Binance took a new snapshot at 00:00 UTC on 31 October and said on Sunday the report was "expected to be available on our PoR website tomorrow", meaning Monday 2 November. Co-chief executive Yi He had earlier named Tuesday 3 November. It had not appeared by early Monday UTC. The snapshot predates the reopening, so it will not show the reserves after the run. Binance has given no date for phase two, the remaining coins.

Prosecutors named

At 18:11 UTC on Sunday the US Secret Service posted: "The U.S. Secret Service continues to investigate the theft of more than $6 billion in cryptocurrency from Binance Global. Within minutes of the incident on Thursday afternoon, Secret Service investigators worked with industry partners to identify and freeze a significant portion of stolen cryptocurrency." It said the work continues with the FBI, IRS Criminal Investigation, the US Attorney's Office for the District of Columbia, the US Attorney's Office for the Central District of California, the Justice Department's Computer Crime and Intellectual Property Section (CCIPS) and its National Security Division.

The Secret Service, the FBI and IRS Criminal Investigation are investigators, the detectives. The other four are prosecutors, the government lawyers who decide whether to bring charges and who go to court. CCIPS is the Justice Department's hacking unit; the National Security Division handles cases involving foreign governments, which fits a theft the FBI has blamed on North Korea.

Frozen coins do not go back to anyone on an investigator's say-so. A prosecutor usually has to ask a judge to seize them through civil forfeiture, a court case brought against the property itself, as the Justice Department has done with crypto from earlier North Korean hacks. Naming the offices shows where any such case, and any indictment, would come from. Nobody has been charged, no forfeiture case has been announced, and North Korea has not responded. Changpeng Zhao thanked the Secret Service: "You acted within minutes to help track and freeze stolen funds, and the work continues."

The laundering moves

Laundering is turning stolen money into money that cannot be traced back to the crime. "North Korean-linked actors have begun a new phase of laundering the funds stolen from Binance," the tracing firm Chainalysis said at 16:59 UTC on Sunday. "After draining $500M from TRON staging wallets, the launderers have started moving onto Solana." Funds were leaving Tron "via Chainflip, Relay, THORChain, NEAR, and other routes", in transfers from under $5,000 to over $100,000.

The tracking account Lookonchain reported at 10:35 UTC that the attacker was swapping 970,522 SOL, about $95.9 million, for bitcoin through the Relay bridge. Early on Monday the XRP stash appeared to move for the first time: Whale Alert, which labels the wallets "Binance Hack 2026", showed two transfers of 40 million XRP, about $50 million each, at 03:55 and 03:56 UTC. Elliptic's last update had said the XRP had not moved. No tracing firm has yet confirmed where it went.

The exchange Gate became the second to freeze accounts. Lookonchain said the attacker had deposited $250,000 there in 12 hours. "We've identified and frozen the two related accounts," Gate said at 03:33 UTC, adding that it "will fully cooperate with law enforcement".

THORChain, a staffless swap service run by independent computers called THORNodes, was still halted on 10 of its 13 chains on Sunday afternoon US time, according to The Block, with no restart date. Its co-founder Chad Barraford said THORNode operators "have zero information that isn't already public."

Scammers followed the crowd. "SCAM ALERT!! there is no compensation for withdrawal suspension," Eowyn Chen posted. "Scammers on over drive now. Be careful," Changpeng Zhao wrote.

Rivals tighten up

The rest of the industry had moved by Friday. Coinbase told Reuters it had adjusted its cold storage, the systems that keep keys offline, "solely out of an abundance of caution". A Kraken spokesperson said: "Full-time teams at Kraken look for potential vulnerabilities every day." Star Xu, chief executive of OKX, wrote: "We need a real-time alert system that allows participants to share information immediately when a hack occurs." Tether said it had frozen nearly $1.57 billion and Circle $800 million. Binance says about $3 billion in all has been frozen; none of them has said whether those figures overlap.

What Binance has still not published is how the attack worked. Its post-incident report, which earlier reports had expected around Sunday evening, had not appeared by Monday morning UTC.