Binance's tracked assets rose by $3.4 billion in the two days after withdrawals came back online, following a hot wallet breach that drained roughly $6.3 billion in tokens from the world's largest crypto exchange. The rebound, which followed a suspension of withdrawals imposed immediately after the October 29 attack, offers the clearest early signal of whether users continue to trust the platform after the biggest hack the industry has seen.

From a 20-Minute Drain to a Phased Reopening

The attack hit on October 29, 2026, at approximately 20:05 UTC. Attackers exploited weaknesses in Binance's hot wallets and pulled tokens across multiple blockchains in about 20 minutes. Hot wallets are the internet-connected balances exchanges keep liquid for day-to-day withdrawals, which makes them the natural entry point in a breach even when the bulk of customer funds sit in offline cold storage. The breach has been attributed to TraderTraitor, a group linked to North Korea, whose hacking units are blamed by authorities for a series of major crypto thefts across the industry in recent years.

Binance froze all withdrawals right after the attack and then set aside more than $6.34 billion in corporate resources to cover the losses in full. Part of that money came from its SAFU reserve — the Secure Asset Fund for Users, an emergency fund Binance created in 2018 for exactly this type of situation — and part came from its futures insurance fund.

The recovery moved fast. By October 31, Binance had replenished approximately 90% of the affected assets, mostly through large token purchases on the open market and over-the-counter deals. That figure was later updated to about 95%.

Outside help mattered as well. Partners froze roughly $3 billion of stolen assets tied to the hack, limiting how much the attackers could actually move or cash out. Binance also published a fresh proof-of-reserves snapshot taken at 00:00 UTC on October 31, which the exchange said confirmed its major assets were fully backed. Proof-of-reserves publishing became a widespread industry practice after the 2022 collapse of FTX, when exchanges came under pressure to show that customer balances were genuinely backed — though a snapshot only attests to a single point in time.

Outflows First, Then a $3.4 Billion Bounce

Withdrawals resumed on November 1, 2026, rolled out in phases across more than 15 networks.

Initial net outflows came to around $3.64 billion. In context, that equals roughly 2.1% of Binance's total assets under management, which stand at approximately $171 billion.

The number then reversed. Binance's tracked assets climbed by $3.4 billion over the two days following the withdrawal restart. Set side by side, the $3.4 billion gain lands close to the $3.64 billion in initial outflows. The exchange did not quite return to where it started, but it came near enough to shift the story from flight to recovery.

One caveat is worth keeping in mind. A tracked asset figure does not separate fresh customer deposits from other movements on the balance sheet. Binance was actively buying tokens to replenish what was stolen, and that buying could account for part of the increase.

Why This Hack Is Different

Exchange hacks are not new. What sets this one apart is scale: at roughly $6.3 billion, the breach marks the largest hack in crypto history. The previous benchmark, Mt. Gox's 2014 breach, involved roughly 850,000 bitcoin — worth about $450 million at the time — and left creditors waiting a decade before repayments began.

The response is also unusual. Many past exchange hacks ended with frozen accounts, socialized losses, or bankruptcy filings. Binance chose to absorb the entire hit with its own money and said customer assets remained intact.

That approach only works if an exchange has deep reserves on hand. Setting aside more than $6.34 billion on short notice is a capacity few platforms in the industry could match.

What This Means for Binance and the Broader Market

For Binance, the two-day rebound is the most important data point since the attack. Covering losses is a balance sheet problem, while keeping customers is a trust problem. The $3.4 billion increase suggests the exchange is making progress on the second, even if part of that number reflects its own replenishment buying.

The initial $3.64 billion outflow still matters. Roughly 2.1% of assets heading for the door within the first phase of reopening is a level that remains manageable for Binance.

The North Korea link adds a geopolitical layer. If the attribution to TraderTraitor holds, the roughly $3 billion frozen by partners becomes a key battleground in the effort to recover the stolen funds.

The immediate items to watch are fairly clear. First, whether the replenishment figure moves from about 95% to full coverage. Second, whether net flows stay positive as all 15-plus networks return to normal operation. Third, whether Binance publishes follow-up proof-of-reserves snapshots to confirm that the October 31 picture holds.

This article is based on reporting by CryptoBriefing; the source article was edited by John Chen. Original report: Binance tracked assets climb $3.4 billion in two days after post-hack withdrawal restart.