Binance Sees $4.65B Withdrawal Spike After Hack, but Says Customer Outflows Are Stabilising

Binance customers withdrew a net $4.72 billion (£3.52 billion) after the cryptocurrency exchange began restoring services following a $6.3 billion (£3.52 billion) hack, as the company sought to reassure users that outflows were stabilising and it would cover the financial impact of the theft.

The cumulative net outflow represented about 2.8 per cent of Binance's assets, Reuters reported on Monday, 2 November. The exchange said withdrawals had eased and that $2.7 billion (£2.01 billion) had flowed back into the platform since services resumed.

The figure followed an earlier snapshot from Binance. Between 06:00 and 15:30 GMT on Sunday, 1 November, the exchange processed $4.649 billion (£3.46 billion) in withdrawals and $1.01 billion (£752 million) in deposits, producing a net outflow of approximately $3.64 billion (£2.71 billion). That was equivalent to 2.1 per cent of the $171 billion (£127.42 billion) in assets Binance reported as of 28 October.

The figures cover different periods: $3.64 billion was the net outflow during the first nine and a half hours after withdrawals began reopening, while $4.72 billion was a later cumulative total. Binance said the initial withdrawal spike had declined and outflows were stabilising. The figures show the scale of customer activity after the breach, but do not establish whether confidence in the exchange has recovered.

Binance Begins Phased Withdrawal Resumption

Binance suspended withdrawals after hackers stole approximately $6.3 billion in cryptocurrency from its hot wallets on Thursday, 29 October. The exchange said the incident affected token assets across multiple blockchains and that it would absorb the financial impact.

The company began restoring withdrawals in stages on Sunday, prioritising assets according to customer demand and completing security checks. The first phase covered 15 crypto assets, including bitcoin, ether, XRP and dogecoin, although availability depended on the relevant asset and network.

By Monday, withdrawals had resumed for bitcoin on the Bitcoin network, ether and some dollar stablecoins on the Ethereum network. Reuters reported that many cryptocurrency withdrawals remained partially suspended, while Binance had also restored US dollar cash withdrawals.

Binance Says 95% of Stolen Assets Replenished

Reuters reported on Sunday, 1 November, that Binance had replenished about 95 per cent of the affected assets by buying replacement tokens. The remaining 5 per cent consisted of less liquid cryptocurrencies that could take longer to source.

The figure followed Binance's own update on Saturday, 31 October, when it said it had replenished 90 per cent of the stolen assets. The exchange said it had set aside more than $6.34 billion in company funds to cover the losses, drawing on part of its Secure Asset Fund for Users (SAFU), its Futures Insurance Fund and its corporate treasury.

Binance said around $5 billion (£3.73 billion) of the funds set aside was held in the exact tokens affected by the attack. It also said it would replenish SAFU, an emergency reserve established to protect users in extreme circumstances.

Replenishment is not the same as recovering the stolen cryptocurrency. Buying replacement tokens can restore the value of affected customer balances, but it does not mean the exchange has retrieved the assets taken by the attackers.

Binance said it had worked with law enforcement and industry partners to freeze approximately $3 billion (£2.24 billion) of the stolen assets on-chain. Frozen funds are not necessarily recovered funds: they may be inaccessible to the attackers while investigations and recovery efforts continue.

FBI Attributes Hack to North Korean Group

The FBI said on Saturday, 31 October, that North Korea was responsible for the theft and identified the activity as the work of TraderTraitor, a North Korean state-sponsored group. The agency said it had observed the attackers converting stolen cryptocurrency primarily into ether and expected further laundering through decentralised finance services and instant swaps.

The attribution is the FBI's assessment. Binance has said it is working with law enforcement and industry partners to trace and freeze the stolen assets.

Binance co-chief executive Richard Teng described the breach as a complex attack involving a compromised laptop and malicious software designed to erase evidence. The company's initial investigation pointed to a compromised DevOps engineer's laptop, which may have enabled access to a service container used to submit unauthorised withdrawal transactions.

Teng later cautioned that the attack was not simply the result of one employee's permissions. Binance said investigators had identified additional breach points and found no evidence that wallet private keys had been leaked. The investigation remained ongoing, and the company had not attributed individual responsibility.

The immediate test for Binance is whether it can restore the remaining withdrawal services while demonstrating that the security weaknesses behind the breach have been addressed. Its ability to trace the stolen assets and provide a clear account of how the attack occurred will also be central to restoring customer confidence.