The exchange reopened withdrawals on Sunday after suspending transactions following a breach that affected $6.3bn worth of digital assets.
Binance said it processed $4.649bn in withdrawals and $1.01bn in deposits between 06:00 and 15:30 GMT on November 1, resulting in net outflows of approximately $3.64bn.
The company said withdrawals initially surged but later declined, with activity stabilising as expected.
The net withdrawals represented just over two per cent of the $171bn in assets Binance managed before the incident.
The exchange said it had replaced approximately 95 per cent of the stolen assets, while the remaining funds could take longer to source.
Binance has repeatedly pledged to cover all losses arising from the breach.
The company said it was using its corporate treasury, futures insurance fund and emergency reserves to replace customers’ assets.
It also said withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, had resumed.
Other services are expected to return in phases after security checks are completed.
However, investigators say funds stolen in the attack are still being laundered.
Alex Zebrick, a senior investigator at blockchain analytics firm Chainalysis, told the BBC’s Today Programme that the attackers were actively moving the stolen assets.
“We continue to see funds being laundered quite actively,” he said.
“The attackers are layering these funds across many thousands of addresses, across thousands of deposits,” he added.
The attack has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group.
The group was previously linked to the theft of $1.5bn from cryptocurrency exchange Bybit in 2025.
The Federal Bureau of Investigation (FBI) published cryptocurrency wallet addresses linked to the group on Saturday and urged industry partners to block transactions involving them.
Binance also contacted cryptocurrency issuers, urging them to freeze affected assets.
The exchange said preliminary investigations suggested the breach may have originated from a compromised laptop belonging to an engineer.
