Following the hack that inflicted losses of roughly USD 6.3 billion, Binance customers can once again withdraw their funds, with the exchange gradually lifting restrictions in phases. Binance itself puts net outflows at USD 3.64 billion, equivalent to 2.1 percent of the assets it holds in custody.

Binance operates as both a trading venue and a custodian, meaning customers leave their funds directly on the platform. That structure makes outflows a direct gauge of customer trust. The exchange counts 335 million registered users, and its latest proof of reserves — a self-published snapshot meant to demonstrate that customer balances are actually backed — showed assets of USD 171 billion. In late October, most of the stolen funds left within about 20 minutes, prompting Binance to temporarily suspend deposits and withdrawals. The FBI attributes the attack to the North Korean unit TraderTraitor, while Binance describes it as the largest crypto theft of all time. Between 06:00 and 15:30 UTC on the day withdrawals resumed, outflows of USD 4.65 billion were set against deposits of USD 1.01 billion.

Binance Reopens Withdrawals in Phases

Since early November, Binance has been releasing withdrawals in several stages. The exchange first reopened tokens such as Bitcoin, Ether and Dogecoin, along with portions of the stablecoins USDC and USDT. On X, the company wrote: "We are taking a phased approach by prioritizing tokens based on the past week data of user demand." Tokens with lower demand follow in later phases.

After deducting deposits, the measurement window leaves a net outflow of USD 3.64 billion. Measured against the USD 171 billion in the proof of reserves dated October 28, 2026, that equals 2.1 percent, with most of the money leaving in the first hours. According to the exchange, deposits remained "substantial" while withdrawals later stabilized. Because tokens with lower demand were still waiting for later phases, the post-reopening flow picture was not yet complete.

Binance founder Changpeng Zhao wrote on X: "98% choose to stay!" Mathematically, that matches the share that remains after a net outflow of 2.1 percent. It remains unclear, however, whether Zhao was referring to users or balances, and the figure comes from the company itself without independent verification.

DefiLlama Counts Higher Outflows Than Binance

Analytics provider DefiLlama, which tracks exchange wallets on the blockchain, reports higher figures. Its dashboard now shows outflows of USD 5.81 billion, up from USD 4.36 billion earlier — a gap of roughly USD 2.2 billion compared with the exchange's number.

A Binance spokesperson called the DefiLlama figure inaccurate and said the exchange's latest post on X comes closest to the truth. According to the spokesperson, the analysis ignores deposits into a new hot wallet — an internet-connected wallet exchanges use for day-to-day transfers — that the exchange set up itself. When an on-chain analysis fails to label a newly created exchange wallet as such, transfers to it appear as outflows even though the funds never leave the exchange. Outsiders cannot verify whether that applies in this case, however. Moreover, the two figures rest on different bases and cut-off dates, which limits any direct comparison.

December 2022 offers a benchmark. At the time, customers pulled more than USD 3 billion from Binance within 24 hours, and the total reached around USD 3.7 billion within a week. The current net outflow is of similar magnitude, although the 2022 figure counted gross withdrawals over a full day, while the new figure is a net value covering roughly nine and a half hours. In percentage terms the two are not comparable, because the exchange managed a different asset base back then.

Binance Covers 95 Percent of the Stolen Assets Itself

Binance says it has already replaced 95 percent of the stolen assets, up from the 90 percent rate it reported earlier. To do so, the company bought tokens worth around USD 6 billion. The remaining 5 percent involves less liquid tokens, whose replacement takes longer; the outstanding gap comes to around USD 300 million. At less than 0.2 percent of the USD 171 billion in assets, that shortfall is relatively small.

According to Binance, the losses will not be passed on to users; the company is instead drawing on its SAFU protection fund — an emergency fund the exchange set up in 2018 to cover user losses in extreme situations — and its own funds. Stablecoin issuer Circle has also blocked part of the loot, reporting that it froze more than USD 1.1 billion in USDC linked to the incident. The exact course of the attack remains unclear, and Binance plans to publish a detailed report once the investigation is complete.

For customers, what ultimately counts is the commitment that the exchange will bear the entire loss. Jay Koh, vice president of the Asia Web3 AI Association, held most of his funds in a cold wallet — offline storage disconnected from the internet — which the hack did not affect, and withdrew nothing. He said he "would not necessarily withdraw everything from Binance," while also calling it "prudent to review exposure, diversify custody arrangements and avoid keeping more assets on any single platform than necessary."

ETF Outflows and Liquidations Follow the Hack

Ari Redbord of TRM Labs commented on the incident: "I get why, for conservative institutional investors, this is unsettling." At a financial institution, he said, a hack means stolen usernames and passwords. A hack at a crypto exchange, by contrast, is "bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people's capital."

On the Friday after the hack, spot Bitcoin ETFs recorded outflows of USD 643 million — the largest daily outflow of October. Redbord put liquidations of leveraged positions at more than USD 1.3 billion. Both figures concern the overall market, not Binance alone.

The two metrics also measure different things. ETF outflows occur when investors redeem shares in exchange-traded funds, while liquidations are the forced closure of debt-financed positions and involve no capital outflow. The figures therefore cannot be compared directly with the withdrawals at Binance. Above all, the data confirms only their proximity in time to the hack; the numbers alone do not establish a causal link.

FBI Attributes the Attack to TraderTraitor

Over the weekend, the FBI blamed the North Korean state-backed unit TraderTraitor for the attack; on Friday, the agency had only said it was working with public and private partners. Investigators observed the group swapping the loot mainly into Ether and expect further money laundering. TRM Labs had previously attributed the attack "with high confidence" to the group, and the patterns resemble earlier attacks that analysts blame on North Korea. Rafe Pilling of security firm Sophos likewise sees "all the hallmarks" of TraderTraitor.

Politically, the attribution is less clear-cut. US President Donald Trump said on Saturday: "We don't know if it's North Korea, but if it is, we'll talk to North Korea about it." Pyongyang has denied state-directed cyber operations for years, and North Korea's mission in Geneva and its embassy in China did not respond to media requests.

At USD 6.3 billion, the case surpasses all previous crypto thefts. The FBI likewise attributed the Bybit hack of February 2025, worth around USD 1.5 billion, to TraderTraitor, making the current loss roughly 4.2 times as large. It also exceeds double the total of all crypto thefts in 2025, estimates for which range from USD 2.7 billion to USD 2.9 billion. US intelligence agencies additionally estimate that North Korea earns at least USD 1 billion a year from crypto hacks and other financial crimes. From here, the markers to watch are concrete: Binance's planned post-incident report and the roughly USD 300 million in less liquid tokens still awaiting replacement.

Source: Crypto Valley Journal — Binance gradually reopens withdrawals after the hack