Binance Outflows Reach $3.64 Billion Following Reopening After $6.3 Billion Security Breach
Binance experienced $3.64 billion in net outflows after phased withdrawals reopened following a massive hot wallet breach.
Binance Outflows Reach $3.64 Billion Following Reopening After $6.3 Billion Security Breach
Binance experienced $3.64 billion in net outflows after phased withdrawals reopened following a massive hot wallet breach.
Binance Net Outflows Surge Following Phased Withdrawal Restart
Binance recorded $3.64 billion in net outflows after it initiated a phased restart of customer withdrawals on November 1, 2026. According to the exchange, the outgoing funds represent approximately 2.1% of its total $171 billion asset base. The company noted that while withdrawal activity spiked immediately after services resumed, overall volumes have since started to decline.
The exchange had frozen withdrawal operations on October 29 following a security breach that drained roughly $6.3 billion from its hot wallets, making it the largest theft in cryptocurrency history. User deposits remained operational and uncompromised throughout the disruption. Upon reopening, Binance prioritized major digital assets including Bitcoin, Ethereum, USDT, USDC, and BNB, with Bitcoin being the first network reactivated.
Recovery Efforts and Reserve Replenishment
Binance reported that it had replenished approximately 95% of the affected funds by early November. The exchange pledged to absorb all financial losses internally by utilizing its Secure Asset Fund for Users (SAFU), futures insurance, and corporate treasury reserves, ensuring no costs are shifted to exchange customers. To assist in restoring public trust, Binance announced plans to publish an updated Proof of Reserves report.
In the immediate aftermath of the October 29 breach, Binance collaborated with stablecoin issuers Tether and Circle to freeze roughly $3 billion of stolen tokens directly at the contract level. Research indicates that total gross withdrawals reached between $3.8 billion and $4 billion within the first ten hours of reopening, highlighting lingering user sensitivity following the system disruption.
Federal Law Enforcement Attributes Attack to North Korean Hackers
The U.S. Federal Bureau of Investigation, alongside the U.S. Secret Service and IRS Criminal Investigation, officially attributed the exploit to the North Korean cyber group TraderTraitor in an October 31 alert. Investigators revealed that the breach originated from a compromised laptop belonging to a DevOps engineer, clarifying that no private keys were leaked during the intrusion.
Law enforcement noted that the perpetrators primarily converted stolen digital assets into Ethereum and attempted to launder funds using decentralized finance protocols and instant swap services. According to blockchain analysis firm Chainalysis, the attackers attempted to bypass stablecoin freezes by utilizing Tron-based lending protocols to generate deposit receipt tokens. Additionally, an unrelated technical failure on THORChain temporarily disrupted one of the hackers' bridge swap routes.
About The Author
