Binance records $6.1 billion in outflows as withdrawals resume
More than $6.1 billion in cryptocurrency left exchange-linked wallets at Binance during the 24 hours after the platform reopened withdrawals following the largest theft from a crypto exchange on record.
The outflow amounted to roughly 3.6% of the $171 billion in assets Binance reported holding before the October 29 attack, in which hackers stole approximately $6.3 billion. The figures, drawn from public wallet tracking by DefiLlama, suggest most customer funds remained on the platform even as clients rushed for the exits during the first hours of restored access.
Binance suspended withdrawals for roughly 45 hours after the breach and began a phased reopening at 06:00 UTC on Sunday, November 1. By 12:36 UTC, access had been restored across all 15 initially supported networks and assets, including bitcoin, ether, Solana, XRP and major stablecoins.
The company said demand surged immediately after the reopening and then eased. During the first nine and a half hours, Binance processed $4.649 billion in withdrawals against $1.01 billion in deposits, producing net outflows of $3.64 billion. Deposits remained substantial throughout, according to the exchange, an indication that not all users were heading for the door.
The scale of the initial rush, followed by a tapering in demand, will be read closely by market analysts. A sustained surge in withdrawal requests in the days ahead would signal deeper erosion of trust, while a rapid normalisation would suggest the exchange has contained the reputational damage.
What the numbers do and do not tell us
The $6.1 billion headline figure deserves caution. It comes from DefiLlama’s tracking of publicly visible wallet movements, which can capture transfers between Binance-controlled addresses as well as genuine customer withdrawals. The data therefore overstates customer departures to an unknown degree.
Even so, the direction of travel is clear. DefiLlama still tracked roughly $129 billion in Binance-linked crypto after the outflows, meaning the platform remains far and away the largest custodial holder of digital assets in the industry. But the 24-hour movement represents one of the sharpest single-day redistributions of exchange-traded crypto on record.
The episode also placed a spotlight on rivals. OKX recorded about $450 million in net inflows over the period, while Bybit received roughly $134 million. The available data cannot prove how much of that money came directly from Binance customers, since inflows to rival exchanges aggregate deposits from all sources. Still, the coincidence of timing, with large net inflows arriving in the very window that Binance was processing a multi-billion-dollar outflow, points to direct migration rather than random market activity.
For competitors, the hack has become an unexpected business opportunity. Exchange operators compete fiercely for custody balances, since deposits underpin trading volumes, lending desks and staking services. A meaningful shift of even a few percentage points in market share among the largest venues would reshape revenue across the sector.
Confidence test passed, or merely postponed?
The reopening was the critical test. The failure of a major exchange to honour withdrawals is the nightmare scenario for the crypto market, the sequence that turned the 2022 collapse of FTX from a solvency question into a full-blown liquidity crisis within days. Investors watching Binance this weekend were asking one question above all: can the exchange actually pay out?
On that narrow measure, the answer appears to have been yes. Withdrawals were processed, phased access was completed across all supported networks in under seven hours, and net outflows of $3.64 billion were absorbed without any reported failures or payment delays. The fact that most assets stayed put reduced immediate evidence of a bank-run-style collapse.
Binance also moved quickly on the balance sheet. The company stated on November 1 that it had replenished about 95% of the stolen assets, with the remaining shortfall consisting largely of less-liquid tokens that take longer to source on open markets. The pace of the replenishment, achieved within roughly two days of the theft, points to substantial reserves and access to deep liquidity, whether from corporate treasury holdings, insurance funds, industry loans or emergency purchases. The company did not detail the sourcing of the recovered assets in the information released.
The FBI attributed the theft to North Korea’s TraderTraitor group, a state-linked hacking collective with a long record of crypto thefts against exchanges, bridge protocols and decentralised finance platforms. The attribution raises the prospect that the stolen funds will prove difficult to recover through law enforcement, given the group’s historical use of laundering infrastructure across multiple jurisdictions. It also places the incident squarely within a pattern of North Korean revenue generation through crypto crime, a threat that Western regulators have flagged as a national security concern as well as a market integrity issue.
Binance’s handling of the incident will now face formal scrutiny. A theft of $6.3 billion from a licensed global exchange will inevitably draw regulatory attention in every major jurisdiction where Binance operates. Regulators will want to know how the attackers obtained signing authority over wallets holding billions in customer assets, whether the breach involved compromised insider credentials, and whether Binance’s security architecture met the standards its licences presume. For further reporting on exchange security incidents, see our Bitcoin coverage.
Market implications and the custody question
The immediate market impact was contained. Bitcoin posted only a small rise as the reopening proceeded, suggesting traders had largely priced in the hack by the time withdrawals resumed. The absence of a sharp selloff is notable, given that the theft ranks as the largest in crypto history. Part of the explanation lies in the fact that the stolen assets came from the exchange’s own holdings rather than triggering forced selling across the market, and part lies in the speed of the reopening, which denied panic a chance to compound.
The longer-term implications are more structural. Every major exchange hack revives the same debate over self-custody, and this one carries unusual weight because of the sums involved. $6.3 billion is an order of magnitude larger than previous record exchange thefts, and the episode demonstrates that even the industry’s largest and most resourced custodian could not prevent state-linked attackers from reaching customer assets.
For institutional allocators, the arithmetic is uncomfortable. A platform that held $171 billion and lost $6.3 billion in a single incident faced an outflow of $6.1 billion in the first day afterwards. That ratio, roughly one dollar leaving for every thirty held, indicates broad retention but also meaningful attrition among exactly the clients exchanges most want to keep: those large enough to move quickly and sensitive enough to custody risk to act on it.
Competing exchanges will now lean hard into security differentiation. Expect renewed marketing of proof-of-reserves attestations, cold-storage ratios and multi-signature architectures across the sector. Whether such claims reassure customers is another matter, since proof-of-reserves mechanisms in their current form verify asset holdings without verifying liabilities in real time, and the last two years have shown that headline security metrics coexist poorly with actual breach outcomes.
The regulatory response deserves equal attention. A theft of this size attributed to a North state actor strengthens the case in Washington, Brussels and elsewhere for stricter custody rules, including requirements for segregated customer assets, independent security audits and mandatory incident disclosure timelines. Exchanges have resisted elements of these proposals as costly and operationally restrictive. The Binance hack hands regulators their clearest evidence yet that the current baseline is not sufficient.
Analysis
The most telling number from the weekend is not the $6.1 billion that left, but the $129 billion that stayed. Binance passed its liquidity stress test, and the market’s muted reaction reflects that. Yet passing a test is not the same as winning back trust. Roughly 95% replenishment of stolen assets and an orderly reopening bought the exchange time, but the FBI’s attribution to North Korea’s TraderTraitor group means the story now moves to uncomfortable questions about how the breach occurred and whether regulators will force structural change. The migration of hundreds of millions toward OKX and Bybit shows customers are not waiting for those answers before hedging their custody exposure. The reputational damage will be measured not in the first 24 hours, but in the net flow trend over the coming weeks. If deposits keep pace with withdrawals, Binance will have survived the worst week in its history largely intact. If outflows grind on, the largest exchange in crypto will face a slower, quieter version of the crisis it just avoided.
