The First Post-Hack Weekend: What Binance's $3.64 Billion Outflow Tells Merchants About Counterparty Risk

The first weekend after a major security incident tests more than an exchange’s technical recovery. It tests whether customers can access their money, whether the provider can meet withdrawals, and whether it can show what remains backed.

Binance’s latest figures offer a useful, if still incomplete, view of that test. They also give merchants and payment teams a reason to look beyond transaction speed when assessing digital settlement providers. The central question is counterparty risk: what happens when the firm holding or moving funds is under pressure?

What changed since Saturday

As we covered on Saturday, the Binance hack raised questions about which assets could be frozen and how a payment provider’s controls might respond to a crisis. The weekend’s new information shifts attention to what happened when withdrawals resumed.

Between 6:00 am and 3:30 pm UTC on Sunday, 1 November, Binance reported $4.65 billion in withdrawals and $1.01 billion in deposits. The resulting net outflow was $3.64 billion. Binance said this equalled 2.1% of its reported $171 billion in assets, using proof of reserves data dated 28 October. The figures describe a nine and a half hour window, not a full day. CNBC reported the figures and Binance’s update.

Withdrawals resumed in phases. By 12:36 pm UTC on 1 November, Binance said all 15 networks and assets in the initial phase were available. It said volumes had declined after an initial surge and were stabilising, while deposits remained substantial. Further withdrawals were planned to resume progressively on Tuesday, 3 November.

Binance also said it had covered about 95% of the impacted amount using its resources. That is a replenishment commitment, not a statement that 95% of funds frozen by issuers had been returned. The remaining 5% consisted of less liquid tokens that Binance said would take longer to source.

Circle told CNBC it had frozen more than $1.1 billion in USDC associated with the incident, up from the more than $800 million reported on Friday. Meanwhile, Binance’s Secure Asset Fund for Users, or SAFU, had about 7,500 Bitcoin remaining after a transfer of 7,499 BTC linked to the incident, roughly half its previous balance. Cointelegraph reported the SAFU balance and the absence of a stated replenishment timeline.

Binance founder Changpeng Zhao posted that “98% choose to stay!” He also wrote: “Trust isn’t earned by what you say in good times. It’s earned by what you do in hard times.” The figures and statements are useful context, but should be read as updates from the company and its former chief executive, not as independent measures of every customer’s confidence.

What the freeze and recovery figures actually show

Circle’s reported freeze is a significant example of issuer intervention at scale. A stablecoin issuer can use its contract controls to freeze tokens. Depending on the circumstances and applicable legal processes, frozen tokens may later be recovered or reissued. But a freeze is not itself a return of funds, and the reported USDC total does not tell us how much has ultimately been returned to Binance or affected customers.

That difference matters to payment teams. A frozen balance can be prevented from moving, but may remain unavailable while an investigation or legal process continues. In Saturday’s article, we discussed TRM Labs’ explanation that frozen assets generally require legal process before they can be returned. For a broader view of why fast on-chain transfers can still encounter delays at conversion and payout stages, see our analysis of the stablecoin sandwich.

The control is also not universal. Bitcoin and Ether do not have a central issuer able to freeze tokens in the same way. Recovery options depend on the asset, the services through which it moves, and cooperation from relevant parties. In other words, the stablecoin freeze is evidence that one intervention mechanism was used at scale. It is not proof that every affected asset can be stopped or recovered.

The outflow number that matters

The $4.65 billion gross withdrawal total is striking. The $3.64 billion net outflow, measured against $171 billion in reported assets, offers a more useful first indicator of how the provider handled the reopening.

That 2.1% figure does not prove that Binance faced no liquidity or solvency risk. Nor is an exchange directly comparable with a bank: customers, asset mixes, withdrawal rules and settlement arrangements differ. But net flows put withdrawals in context by accounting for deposits during the same period.

For merchants, the operational question is whether a provider can continue processing withdrawals and settlement obligations during stress, and whether it communicates clearly about any restrictions. Binance’s report that outflows were stabilising is relevant, as is the substantial volume of deposits. Neither statement removes the need for independent checks or ongoing monitoring.

The SAFU balance adds another part of the picture. A reserve fund can help absorb losses, but its balance, purpose and replenishment policy matter. If a provider relies on a protection fund in a crisis, merchants should understand what the fund covers, how it is funded and what happens after it is used.

Proof of reserves becomes table stakes

On 2 November, Binance made a new zero knowledge proof of reserves available for customers to verify. The snapshot covered ten cryptocurrencies and showed that the listed customer balances were backed at least one to one at the snapshot time. Binance said it planned to take another snapshot covering more tokens on 4 November. The Guardian reported the snapshot and Binance’s next update plan.

A zero knowledge proof can help customers check that their balances are included and backed without publicly revealing every customer’s account details. It is useful disclosure, but it has boundaries. A snapshot reflects a particular point in time and a defined set of assets. It is not a real time view, a complete audit of every risk, or a guarantee that withdrawals will always be available.

For Australian merchants, the direction of travel should be familiar. As the RBA’s work on merchant fee transparency illustrates, published information helps businesses compare providers and understand costs. Settlement counterparties holding customer funds should face a similar expectation: publish what is held, how it is verified, which assets and liabilities are in scope, and how often the information is refreshed.

For B2B payment operations, that transparency should sit alongside clear limits and controls on how funds can move. Our analysis of transaction level controls in B2B payment automation looks at why granular permissions matter as workflows become more automated.

A seven point checklist for merchants and payment teams

Frequently asked questions

Did customers lose money?

Binance said it would absorb the financial impact of the stolen funds rather than pass the losses to users, and reported that it had covered about 95% of the impacted amount. That is the company’s stated position. The remaining 5% was described as less liquid tokens still to be sourced.

How much was frozen, and how much was recovered?

Circle reported freezing more than $1.1 billion in USDC associated with the incident. Binance separately said it had covered about 95% of the impacted amount. These figures describe different things: a freeze prevents certain tokens from moving, while coverage refers to Binance replenishing affected assets. They should not be added together or treated as the same measure.

What is a zero knowledge proof of reserves?

It is a cryptographic method that can let customers verify that their recorded balances are included in a reserve check, while limiting disclosure of individual account information. Its value depends on the snapshot’s timing, assets and liabilities in scope, and the verification method.

What should merchants watch next?

Watch the planned 4 November snapshot, whether Binance covers the remaining 5% of impacted assets, whether outflows continue to stabilise, and whether further withdrawal phases proceed as planned.

What to watch

The post hack weekend has supplied more than a headline outflow figure. It has shown how a large settlement counterparty reports its recovery, how an issuer freeze works in practice, and how quickly customer access and confidence can become operational concerns.

The next test is whether the next snapshot expands coverage and gives customers a clear way to verify it. Merchants should also watch whether the remaining affected assets are covered and whether outflows continue to stabilise.

For payment teams, the lasting question is whether proof of reserves becomes a standing expectation for any settlement counterparty holding customer money. The answer should shape vendor due diligence before the next incident, not after it.