Binance's tracked wallets bled $2.51 billion in net outflows on Nov. 1, the day the exchange reopened withdrawals after a $6.3 billion security breach. The exit was led by stablecoins and bitcoin: roughly $1.08 billion in USDT and $912 million in BTC, according to DeFiLlama data. USDC and wrapped ether followed at about $385 million and $131 million.
What left the wallets
The composition matters as much as the total. More than $1 billion of the outflow was USDT, the kind of move that usually signals users parking funds somewhere else rather than rotating into another token. Bitcoin accounted for the next biggest slice at $912 million. Add USDC at $385 million and wrapped ether at $131 million, and you have four assets doing nearly all of the work.
DeFiLlama's tracker covers wallets tied to the exchange, so the figures reflect net movement across those addresses, not a single hot wallet. That's the number to watch when users decide whether they trust a venue again.
Timing wasn't subtle
The outflows landed on the same day Binance resumed withdrawals. That is about as direct a vote of no confidence as on-chain data gets. Users who had been stuck waiting for the queue to clear pulled funds the moment they could. The $6.3 billion breach is the backdrop for all of it, and the reopen gave account holders their first clean shot at the exits.
This isn't a slow bleed spread over a week. It's concentrated on one day, right after access returned.
The stablecoin signal
USDT leading the pack is worth flagging. When bitcoin dominates an outflow, it can read as traders repositioning. When stablecoins dominate, it reads more like people moving cash off the platform entirely. Both happened here, but the stablecoin share is the one that says users wanted out, not just into a different coin.
Whether those funds come back is the open question. Exchange outflows tied to a security incident tend to reverse slowly, if at all, until there's a clear account of what went wrong and what's been fixed. Binance hasn't given a timeline for that, and the data so far only covers the first day of reopened withdrawals.
