Binance recorded $4.65 billion in customer withdrawals and $1.01 billion in deposits within a nine-and-a-half-hour period on November 1. This activity followed a major breach that had occurred days earlier, which saw hackers reportedly steal $6.3 billion from the platform. The net outflow of approximately $3.64 billion amounted to 2.1% of Binance’s $171 billion in reported assets under management.
Withdrawals spike after service restoration
Binance is one of the world’s largest cryptocurrency exchanges, offering spot, derivatives, and various blockchain-based services to millions of users globally. The platform began restoring withdrawal services at 06:00 UTC on November 1, gradually resuming transfers across 15 different networks, including Bitcoin, Ethereum, Solana, Tron, BNB Smart Chain, and XRP Ledger. By 12:36 UTC, withdrawals had resumed for all assets included in the initial recovery phase.
A surge in withdrawal volume was observed immediately after services reopened. Charts showed the largest withdrawal amounts during the initial phase, with volumes tapering off in subsequent 30-minute intervals as network operations stabilized. Deposits continued throughout the window but remained well below the withdrawal figures, failing to offset the outflows.
Binance noted that withdrawal volumes spiked after transfer services resumed, but these volumes declined and started to stabilize as operations normalized.
The reopening was conducted in phases, shaped by which networks and assets users most urgently needed, as well as operational and security considerations. Although most services came back online within a few hours, some users faced lingering delays while remaining networks completed necessary checks.
According to DefiLlama, net outflows from Binance on Sunday exceeded $3.5 billion, closely matching the $3.64 billion figure reported by Binance for the same period.
| Timeframe | Withdrawals | Deposits | Net Outflow |
|---|---|---|---|
| Nov 1, 06:00–15:30 UTC | $4.65B | $1.01B | $3.64B |
Security breach and asset recovery efforts
The withdrawals followed an incident on October 29 involving a hot-wallet breach, attributed by the FBI to North Korea’s TraderTraitor operation. This threat group is known for targeting cryptocurrency platforms to fund activities proscribed under international sanctions.
Binance stated that a compromised engineer’s laptop may have allowed unauthorized access through a service container, but investigators had not identified leaked private keys. The exchange, working with partners, reported that approximately $3 billion in stolen assets were frozen following the breach.
Binance also said it used company funds to restore about 95% of all affected token balances, independently from the recovery of stolen funds. The exchange described customer withdrawal conditions as stabilizing but cautioned that the outflow volume still exceeded new deposits.
A Proof of Reserves snapshot was taken on October 31, with Binance reporting that ten major assets remained fully backed. This audit, however, was completed before the wave of withdrawals and does not reflect any changes to reserves afterward. The accompanying zero-knowledge proof verification was still pending and expected to be released publicly by November 3.
Binance pledged to cover any losses itself as it continued to restore operations and complete reserve verification. The exchange emphasized that security reviews and staged restarts would continue until all networks were fully reinstated.
Mini dictionary: Proof of Reserves, or PoR, refers to an independent audit process used by cryptocurrency exchanges to verify they truly hold customer assets, often by providing cryptographic evidence that asset balances are fully backed without revealing sensitive information.
Binance confirmed that it froze $3 billion in stolen crypto assets with its partners and stated it was replenishing affected customer balances, separate from any ongoing asset recovery.
