Binance co-founder Changpeng Zhao said the exchange recorded a 2.1% net outflow after withdrawals were restored following a security incident. Most of the withdrawals occurred during the first few hours, while more than $1 billion in funds moved through the platform during the 12-hour period, according to Binance’s verified account, which republished Zhao’s statement.
“98% choose to stay,” Zhao wrote in the post, presenting the figure as evidence that customers retained confidence in Binance during a disruption. He added that trust is demonstrated by how a company responds during difficult periods, rather than by statements made in normal conditions.
The claim offers Binance’s first public account of customer behavior after withdrawals were temporarily restricted. It indicates a concentrated wave of withdrawals when access was restored, followed by what the exchange characterizes as a more limited net reduction in assets.
However, Binance did not publish a detailed calculation alongside the statement. Zhao did not specify which assets were included, whether the 2.1% figure referred to customer balances or exchange wallet flows, or how Binance treated transfers between its own products. The post also did not identify the number of customers who withdrew funds or disclose an independent review of the data.
Withdrawals resumed after security checks
Binance said withdrawals were restored progressively on November 1, 2026, after the exchange completed security checks. In its official recovery notice, Binance said withdrawals would resume in phases and that it would cover stolen funds and replenish affected assets.
A phased reopening can reduce operational risk after a security event, but it also makes the timing of customer activity important. Users who withdrew immediately may have been responding to uncertainty about access, custody or the scope of the incident. Others may have moved funds only temporarily while waiting for more information.
That distinction matters because a net outflow measures the difference between assets leaving and entering an exchange. It does not necessarily show how many users withdrew, whether a smaller group accounted for most of the movement, or whether customers transferred assets to another Binance service rather than to external wallets.
The timing also limits what can be inferred from the 12-hour snapshot. A user may keep assets on an exchange during the first day and withdraw them later, particularly if the security incident remains unexplained. Conversely, some customers may return assets after moving them temporarily during the reopening period.
Different measurements produce different results
Outside coverage has raised questions about the gap between Binance’s figure and estimates based on blockchain data. The Information cited DefiLlama data and reported a $5.8 billion estimated net outflow, a substantially larger amount than the exchange’s own reported figure.
That comparison does not by itself establish that Binance’s account is inaccurate. Exchange disclosures and on-chain tracking systems can measure different wallets, assets and time periods. Some exchange addresses may not be publicly identified, while blockchain analysts may include flows that Binance excludes from its internal calculation.
CryptoCompass made that point in a separate critical assessment. CryptoCompass said the 2.1% figure and external on-chain estimates may cover different windows and wallets, while also noting that Binance has not released an hourly breakdown or sufficient methodology to independently verify its claim.
The available outside assessments are critical of the evidentiary basis for Binance’s number, not necessarily proof that the exchange lost control of customer funds. Only critical outside assessments were found in the supplied sources. No independent source in that material offered a contrary measurement supporting Binance’s figure.
What the number can and cannot show
If accurate and measured against total customer assets, a 2.1% net outflow would suggest that the withdrawal rush did not become a sustained run on the exchange during the first half-day. It would also support Binance’s argument that its response, including the promise to cover stolen funds, helped prevent a broader loss of confidence.
But the “98%” figure requires particular caution. Zhao’s post does not explain whether it means 98% of customers kept all assets on Binance, 98% of users did not fully close their accounts, or 98% of users remained active in some form. Those interpretations describe materially different levels of customer confidence.
For regulators, institutional clients and other exchanges, the episode illustrates why incident reporting requires more than a headline flow figure. A useful disclosure would identify the assets covered, define the measurement window, distinguish internal transfers from withdrawals to external wallets and provide a wallet-level reconciliation that can be reviewed independently.
Longer-term data will be more informative than the first 12 hours. Binance’s subsequent balances, additional withdrawal activity and explanation of the security incident will show whether the initial outflow was a temporary reaction or the beginning of a broader change in customer behavior. Until those details are available, the 2.1% figure is best understood as Binance’s own account of an early recovery period, rather than a verified measure of customer retention.
- Aevozer · CC BY-SA 4.0
Sarah Thompson is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Sarah Thompson's usual length and in Sarah Thompson's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
Read and checked by admin on 11/2/2026
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.