Binance Restarted Withdrawals and $4.65 Billion Walked Out in 9.5 Hours — 95% of the $6.3 Billion Is Replaced, and $80,000 Is the Line Bitcoin Needs Back

Binance opened the doors on Sunday morning and the queue became the story. The exchange started phase one of its withdrawal restart at 06:00 UTC and, over roughly nine and a half hours, pushed out about $4.65 billion against $1.01 billion of deposits coming in. That is a net $3.64 billion leaving the building — roughly 2.1% of the $171 billion of assets on its 28 October proof-of-reserves snapshot — on the first day the money was allowed to move since Thursday night.

Nothing broke. That is the point of the day, and the reason bitcoin is trading higher into Monday rather than lower.

What phase one actually reopened

The first window ran 06:00 to 09:00 UTC across fifteen networks. Bitcoin led, alongside ether, USDT, USDC, BNB and XRP, with the most-requested chains prioritised. Everything after that is conditional: each additional blockchain reopens only once it clears further security and stability checks, and by Sunday evening coins such as ADA, LINK, LTC and NEAR were still in testing. CoinDesk's report on the restart has the running list.

Binance also put a hard number on the hole it is filling. About 95% of the stolen assets have now been replaced using company funds, up from roughly 90% a day earlier, including draws on its Secure Asset Fund for Users. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are stated as fully backed at 100%, with an updated zero-knowledge proof-of-reserves report projected for Monday.

How the $6.3 billion breaks down

Theft estimates cluster around $6.3 billion, the largest crypto hack on record, taken from hot wallets late Thursday. TRM Labs' breakdown is the most concrete public tally: 18,270 BTC worth about $1.47 billion, 200,630 ether, 1.875 billion USDT and 823 million USDC on Ethereum, plus 233.46 million XRP, 970,500 SOL and further USDT from other chains. The losses are being absorbed by the company rather than passed to users.

The FBI put a name on it

On Saturday the FBI attributed the theft to North Korea's TraderTraitor group — the same actors tied to last year's roughly $1.5 billion Bybit hack — and published 628 addresses for the industry to block. The bureau, working with the Secret Service and IRS-CI, said the attackers are converting the proceeds primarily into ether, with laundering expected through DeFi venues and instant-swap services. THORNode operators, RPC providers and analytics firms were named specifically.

That converts an exchange incident into an enforcement operation, and it changes the recovery maths. Stolen coins that exchanges are obliged to freeze are harder to sell, which is a large part of why the market did not price Sunday as a second leg lower.

Where the capital went instead

Out of Binance, into its competitors. DefiLlama measured about $4.05 billion of net outflows from Binance over 24 hours while the next ten largest venues it tracks took in a combined $368 million, OKX alone absorbing about $316.8 million. That is rotation, not exit — the coins are moving to other custodians, not to fiat.

The ETF channel told a different story. US spot bitcoin funds lost $643.2 million on Friday, the biggest single-day withdrawal since 25 June, ending a four-day $440.8 million inflow run. BlackRock's IBIT led at $233.7 million, Fidelity's FBTC followed at $201 million, ARKB at $129.5 million, GBTC at $53.3 million and BITB at $25.7 million, with no fund printing an inflow. October closed roughly $515.9 million negative, cumulative net inflows slipped to about $57.4 billion, and total net assets sit near $103.2 billion. Ether funds were worse: $155.7 million out on Friday, a fifth straight red session, and about $1.61 billion of October outflows. Farside's flow table is the cleanest place to watch Monday's print.

The two prices that matter

Bitcoin opened October at 83,623.59 and closed it at 77,582.02 — 7.2% lower — with the monthly low at 76,325.98. Sunday's session ran from a 77,517.20 low to a 78,422.23 high and is trading at 78,350, up about 1% on the day.

Two levels frame the week. On the downside, $75,000 is the support Bitfinex's desk has flagged, and the 76,325.98 October low is the tripwire in front of it. On the upside, the recovery case needs $80,000 reclaimed, with the 84,250 area the next overhead shelf beyond that. Futures positioning supports the caution: open interest sits at a five-week high near 686,000 BTC and longs made up 79% of liquidations during the selloff. The Fear and Greed index ran from 70 on 4 October to the mid-30s by month-end, bitcoin dominance is 59.3% and the total market is $2.64 trillion.

What to watch this week

Three things are time-stamped. Monday brings the refreshed zero-knowledge proof-of-reserves, the first independent read on whether the 95% replacement is real. Phase two of the withdrawal restart follows the same day-cycle rhythm, with ADA, LINK, LTC and NEAR the names still waiting. And Monday's US ETF session is the first chance for institutional money to answer Friday's $643.2 million exit.

Off the tape, Canada's OSFI crypto capital rules for the Big Six banks took effect on 1 November, and USDC's dual EU supervision as a significant e-money token begins on 12 November. Neither will move Sunday's withdrawal queue, and both change who is allowed to hold the assets next year.

Read together, day one of the restart did what a stress test is supposed to do: it produced a large number that did not become a run. The coins that left went to other exchanges, the reserves were topped up before the doors opened, and the price closed higher than it opened. The next test is not whether Binance can pay — it is whether $80,000 or 76,326 breaks first.