Binance faces $3.64 billion in net outflows after a $6.3 billion hack

Binance recorded $3.64 billion in net outflows after it reopened withdrawals following a theft estimated at $6.3 billion to $6.4 billion, depending on the report.¹³⁵ The stolen sum was described as an unprecedented cyber theft, and the difference between the two estimates reflects how reports framed its size.¹ A separate figure from Binance put net withdrawals at $4.7 billion by Monday morning in London.¹ The two outflow totals do not necessarily conflict: they were reported for differing periods or calculated on different bases.¹ By Binance’s spokesperson’s comparison, $4.7 billion was under 3% of its $166 billion in assets; the other report put $3.64 billion at 2.1% of $171 billion.¹⁵

The $3.64 billion total came after withdrawals resumed on Sunday, whereas the $4.7 billion estimate was reported by Monday morning in London.¹³⁵ For a specified interval on Nov. 1, Binance said it handled $4.65 billion in withdrawals and received $1.01 billion in deposits.⁵ Those deposits reduce the withdrawal total to a net figure; the reported $3.64 billion is therefore not the same measure as gross withdrawals.³⁵ The 2.1% comparison uses Binance’s latest available proof-of-reserves figure, $171 billion, dated Oct. 28, rather than the $166 billion cited by its spokesperson.¹⁵ The company also reported that withdrawal activity eased after its first surge and then steadied, while incoming funds remained substantial.⁵

The breach was detected on Thursday evening, and Binance began freezing stolen assets with help from industry partners, including stablecoin issuers.¹ That effort immobilized nearly half of the funds taken, according to the report.¹ A separate Friday update said Binance and blockchain partners were seeking to freeze roughly $3 billion in affected assets as recovery work began.⁴ The attacker was reported to have drained about $6.4 billion from hot wallets on roughly 10 blockchains, with most of the theft occurring in 20 minutes on Thursday afternoon.³ On Ethereum, the account said, 50 authorizations signed in advance enabled the attacker to convert a Binance hot wallet into a self-draining contract; the weakness was attributed to Binance’s approval process, not Ethereum.³

Binance initially pointed to a DevOps engineer’s compromised laptop, then reported finding other points through which the breach had occurred.³ The company said it would make customers whole and reported that it had covered about 95% of the total by Sunday.¹ A later account said the remaining 5% involved tokens that were less liquid and would take longer to obtain in the necessary amounts.⁵ Decrypt reported that Binance had earmarked more than $6.34 billion of company funds for reimbursement, with about $5 billion already held in the same tokens.³ The same report said Binance needed to purchase roughly $1.3 billion in BTC, ETH and BNB through open-market and over-the-counter transactions to replenish its reimbursement pool.³

Withdrawals returned in stages from 6 a.m. UTC on Sunday, rather than becoming available everywhere at once.⁵ By 12:36 p.m. UTC, the initial stage covered all 15 networks and assets included in that phase, while Binance continued testing other services.⁵ Thus, the announcement that withdrawals had resumed did not mean every network or asset was immediately ready for use.¹⁵ The company said withdrawal activity remained within its expectations and that deposits were rising steadily.¹ Changpeng Zhao wrote on X that 98% of users chose to stay and that most net outflows came in the first couple of hours after reopening.⁵

The net-flow totals should not be read as a count of customers who left, because Yi He said some withdrawals were transfers between Binance wallets.¹ That distinction matters: a movement recorded as an outflow can reflect an internal transfer rather than a customer taking funds away from the exchange.¹ Julia Zhou said market participants are tracking net flows, deposits returning to the platform, liquidity for trading, market depth and transfers to other venues.¹ She identified ordinary trading conditions as the more important test, placing the withdrawal totals among several indicators rather than treating them as a complete account of the exchange’s condition.¹ Nick Smart said Binance remained the leading exchange and was not close to losing that position despite the withdrawals.¹

The company’s response unfolded alongside a largely steady market: Bitcoin was near $77,700 on Monday with little change, and the wider digital-asset market was also relatively stable.¹ That broad market picture does not erase evidence of pressure in other products: Decrypt reported $643.3 million in Bitcoin ETF outflows on Friday.³ Those ETF flows shifted October’s reported result from a $127 million gain to a $515.9 million loss.³ Zhou compared the episode with Bybit’s roughly $1.5 billion North Korea-linked exploit the previous year, after which an early withdrawal rush eventually settled.¹ The comparison offers a precedent for stabilization, but Zhou’s stated test for Binance remained how trading and liquidity behave under normal conditions.¹

The FBI and Secret Service opened investigations into the Binance incident, according to Decrypt.³ Decrypt also quoted the FBI as saying it was coordinating investigative work with public-sector and private-sector partners.³ A U.S.-based blockchain intelligence firm, TRM, assessed that TraderTraitor, described as North Korea’s elite hacking unit, was the most likely perpetrator.⁴ That attribution was presented as TRM’s assessment, not as a finding by the investigators.³⁴

The CFTC chairman said the breach supported his agency’s view that offshore exchanges do not have adequate safeguards and proposed a federal registration route tied to U.S. cybersecurity standards.³ The episode also sits within Binance’s history as an exchange founded by Changpeng Zhao in 2017 that grew to lead rivals, including Coinbase and FTX, in trading volume.⁴ Zhao pleaded guilty to a Bank Secrecy Act violation, left the chief executive role and served four months in jail; the article described him as the first person imprisoned after pleading guilty to that law in 2024.⁴ The same article said President Donald Trump pardoned Zhao in October last year, and Binance denied that its assistance was exchanged for the pardon.⁴ These facts provide context for the attention around Binance, while the reported withdrawal figures still describe flows measured over particular periods and against different asset totals.¹³⁵