Edition · Mon 02 Nov 2026
Crypto Desk
Binance Says the Rush for the Exit Is Slowing After the $6.3 Billion Hack
Binance said withdrawals were stabilising as it resumed service after a $6.3 billion theft, with net outflows reaching $3.64 billion, or 2.1% of assets, while bitcoin traded above $78,000.
Not investment advice: this article is for information only.
By Rachel · Edited by Chanan Zevin - Chief Editor and Head of Desks
Published
Deposit flows steady as services resume
Binance customers pulled $3.64 billion, or 2.1% of its assets, as the exchange resumed service following a security breach linked to North Korea that saw $6.3 billion stolen from the platform, on Monday, Nov 2.
Deposit flows steady as services resume
The exchange said customer withdrawals were stabilising following an initial surge and that deposit volumes remained substantial. Binance, which counts 335 million registered users globally, reported on Sunday that it held $171 billion in total assets under management as of October 28.
Deposit flows steady as services resume
The net outflow figures reflected the combined impact of client withdrawals and deposits following the incident, Binance said. Crypto analytics platform DefiLlama published dashboard figures showing outflows reached $5.81 billion, revised upward from an earlier $4.36 billion, though a Binance spokesperson stated the platform metric did not account for funds deposited into the exchange's new hot wallet.
Tokens replaced as digital assets steady
The exchange said it covered 95% of the stolen assets, spending its own funds to purchase $6 billion worth of replacement cryptocurrencies, on Sunday. Binance stated that the remaining 5% of stolen tokens involved less liquid assets that could require additional time to source across secondary markets.
Tokens replaced as digital assets steady
Withdrawals returned through a phased schedule prioritising 15 tokens based on recent trading demand, including bitcoin, ether, dogecoin, and portions of USDC and USDT, Binance announced on X. Bitcoin rebounded over the weekend from a six-week low recorded on Friday to trade above $78,000 on Monday, while ether recovered slightly to $2,287 after touching a two-month low on Friday.
Tokens replaced as digital assets steady
For market participants, the swift recovery of trading infrastructure and collateral reserves is critical because prolonged disruption at the dominant centralised venue risks triggering liquidity contagion and shaking institutional confidence across broader digital asset markets.
Institutional outflows hit funds and stablecoins
Broader market gauges registered sharp contractions immediately after the breach. US spot bitcoin exchange-traded funds recorded $643 million in outflows on Friday, marking the largest single-day withdrawal of October, while more than $1.3 billion in leveraged trading positions were liquidated, according to Ari Redbord, global head of policy at TRM Labs.
Institutional outflows hit funds and stablecoins
Capital also exited dollar-pegged tokens, with the combined market capitalisation of the two largest stablecoins, USDT and USDC, dropping by about $1.2 billion since Friday, Coinmarketcap.com reported. The heist followed a broader pattern documented by TRM Labs, which calculated that attackers stole $2.9 billion across nearly 150 cryptocurrency incidents last year.
Institutional outflows hit funds and stablecoins
Individual institutions began reviewing risk exposure following the disruption. Jay Koh, vice president at the Asia Web3 AI Association, said that while he kept his holdings on the exchange because cold wallets avoided the intrusion, market participants should diversify custody arrangements and avoid concentrating excess capital on any single trading venue.
Investigators track rapid Thursday exploit
The Federal Bureau of Investigation said on Saturday that TraderTraitor, a North Korean state-sponsored cyber unit, carried out the theft. Law enforcement personnel observed unit members converting proceeds into ether, and the bureau stated that it anticipated further laundering of the funds.
Investigators track rapid Thursday exploit
The bulk of the transfer occurred within roughly 20 minutes late on Thursday and displayed technical hallmarks of earlier breaches linked to Pyongyang, according to blockchain intelligence firms TRM Labs and Chainalysis. North Korea has consistently denied deploying state-sponsored units for cyber operations, financial crime, or foreign currency acquisition.
Investigators track rapid Thursday exploit
Political reactions diverged over the weekend regarding formal culpability. United States President Donald Trump said on Saturday that direct North Korean involvement remained unconfirmed, telling reporters in remarks published on X that the administration would open discussions with Pyongyang if investigators confirm its role.