Binance Returns to Net Inflows After More Than $7 Billion in Post-Hack Withdrawals

Flows reverse after the initial exodus

According to DefiLlama data cited in the report, Binance’s onchain wallets showed net inflows of about $3.25 billion over 24 hours as of Nov. 3. The exchange’s tracked onchain assets were estimated at roughly $128.8 billion at that time.

That marked a sharp reversal from the period immediately after the hack, when Binance recorded more than $7 billion in daily outflows. The report said that by around 03:00 UTC on Nov. 3, hourly deposits had begun exceeding withdrawals, pointing to a shift in near-term activity on the platform.

Longer windows still show heavy net outflows

Despite the positive daily figure, the larger trend remained weak. DefiLlama still showed around $12.16 billion in seven-day net outflows and about $10.85 billion over 30 days.

Those rolling totals can change quickly as large transfers move into or out of the measurement period, but they still underline the scale of the post-hack withdrawal wave. A single day of net inflows did not offset the broader drain in customer assets tracked onchain.

Binance data and Zhao comments point to self-custody moves

The report also cited Binance’s own shorter-term figures from earlier Tuesday. During the first 46 hours after withdrawals began reopening, the exchange showed $10.97 billion in withdrawals against $5.70 billion in deposits, leaving a net deficit of about $5.28 billion over that span.

Co-founder and former chief executive Changpeng Zhao said on X that only a small portion of withdrawn funds appeared to be heading to rival centralized exchanges. He said an estimated 6% to 10% of withdrawals moved to other CEX platforms, while most went to self-custody wallets and had not interacted with a decentralized exchange.

Security response and the next signal to watch

Binance paused withdrawals after the breach while carrying out security checks, then reopened them in stages and expanded support to additional assets. The exchange has said it covered customer losses with its own resources.

Co-founder Yi He said the incident took place against a wider backdrop of repeated cyber threats. According to the report, Binance’s security team detected and prevented 57 suspected North Korea-linked cases during 2026, involving tactics such as fake job interviews, malicious developer tools, compromised software packages, browser extensions, fake video-conferencing apps, and broader social-engineering efforts.

Co-CEO Richard Teng said Binance was beginning to see more positive inflows. The next confirmed test for the exchange is whether those inflows continue as services fully normalize, since sustained positive flows would be a stronger sign that user confidence is rebuilding after the hack.