Following the Binance hack, which caused losses of around USD 6.3 billion, customers can gradually withdraw their funds again. Binance puts net outflows at USD 3.64 billion, equal to 2.1% of the assets it holds in custody.
As a centralized exchange, Binance acts as both trading venue and custodian. Customers leave their funds on the platform, so outflows serve as a gauge of their trust. The exchange counts 335 million registered users. Its latest proof of reserves showed assets of USD 171 billion. In late October, most of the stolen funds left within about 20 minutes. Binance therefore temporarily suspended deposits and withdrawals. The FBI attributes the attack to the North Korean unit TraderTraitor. Binance, meanwhile, calls it the largest crypto theft of all time. Between 06:00 and 15:30 UTC on reopening day, withdrawals of USD 4.65 billion faced deposits of USD 1.01 billion.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
Binance reopens withdrawals in phases
Since early November, Binance has been releasing withdrawals in several phases. The exchange first opened tokens such as Bitcoin, Ether and Dogecoin, along with parts of the stablecoins USDC and USDT. On X, the company wrote: "We are taking a phased approach by prioritizing tokens based on the past week data of user demand." As a result, tokens with less demand follow later.
After deducting deposits, the measurement window leaves a net outflow of USD 3.64 billion. Measured against the USD 171 billion in the proof of reserves dated 28.10.2026, that equals 2.1%. Most of it left in the first hours. According to the exchange, deposits remained "substantial" while withdrawals later stabilized.
Binance founder Changpeng Zhao wrote on X: "98% choose to stay!" Mathematically, that matches the share that remains after a net outflow of 2.1%. Still, it remains unclear whether Zhao means users or balances. In addition, the figure comes from the company itself and lacks independent verification.
DefiLlama measures higher outflows than Binance
Analytics provider DefiLlama, which tracks exchange wallets on the blockchain, reports higher outflows. Its dashboard now shows USD 5.81 billion, up from USD 4.36 billion earlier. That leaves a gap of around USD 2.2 billion to the exchange's figure.
A Binance spokesperson called the DefiLlama figure inaccurate. In the spokesperson's view, the exchange's latest post on X comes closest to the truth. The analysis ignores deposits to a new hot wallet that the exchange set up itself, the spokesperson said. If an on-chain analysis fails to label a new exchange wallet as such, transfers to it appear as outflows. Yet the funds remain with the exchange. Outsiders cannot verify whether that applies here, though. Moreover, the two figures rest on different bases and cut-off dates, so a direct comparison has its limits.
December 2022 provides a benchmark. At the time, customers pulled more than USD 3 billion from Binance within 24 hours. Within a week, the figure reached around USD 3.7 billion. The current net outflow has a similar magnitude, although the 2022 figure counted gross withdrawals over a full day. The exchange's new figure is a net value from about nine and a half hours. In percentage terms, however, the figures do not compare, because the exchange managed a different asset base back then.
Binance covers 95% of the stolen assets itself
Binance says it has replaced 95% of the stolen assets. Earlier, the exchange had reported a rate of 90%. To replace them, the company bought tokens worth around USD 6 billion. The outstanding 5% involves less liquid tokens, so replacing them takes longer. The remaining gap thus comes to around USD 300 million. At less than 0.2% of the USD 171 billion in assets, that is relatively small.
According to Binance, it does not pass the losses on to users. Instead, it draws on its SAFU protection fund and company funds. Circle has blocked part of the loot. The stablecoin issuer reports that it froze more than USD 1.1 billion in USDC linked to the incident. The exact course of the attack remains unclear. Binance plans to publish a detailed report once the investigation is complete.
For customers, what ultimately counts is the commitment that the exchange will bear the entire loss. Jay Koh, vice president of the Asia Web3 AI Association, held most of his funds in a cold wallet. The hack did not affect that wallet. Because of that, he withdrew nothing. He "would not necessarily withdraw everything from Binance," Koh said. At the same time, he considers it "prudent to review exposure, diversify custody arrangements and avoid keeping more assets on any single platform than necessary."
ETF outflows and liquidations follow the hack
Ari Redbord of TRM Labs commented on the Binance hack: "I get why, for conservative institutional investors, this is unsettling." At a financial institution, he said, a hack means stolen usernames and passwords. A hack at a crypto exchange, by contrast, is "bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people's capital."
On the Friday after the hack, spot Bitcoin ETFs recorded outflows of USD 643 million, October's largest daily outflow. Redbord put liquidations of leveraged positions at more than USD 1.3 billion. Both figures concern the overall market, not Binance alone.
Furthermore, the two metrics measure different things. ETF outflows occur when investors redeem shares in exchange-traded funds. Liquidations, on the other hand, mean the forced closure of debt-financed positions and thus involve no capital outflow. Consequently, the figures do not compare directly with the withdrawals at Binance. Above all, the data confirms their proximity in time to the hack. The figures alone do not establish a causal link.
FBI attributes the Binance hack to TraderTraitor
Over the weekend, the FBI blamed the North Korean state-backed unit TraderTraitor for the attack. On Friday, the agency had only said it was working with public and private partners. Investigators watched the group swap the loot mainly into Ether and expect further money laundering. TRM Labs had previously attributed the attack "with high confidence" to the group. The patterns resemble earlier attacks that analysts blame on North Korea. Rafe Pilling of security firm Sophos also sees "all the hallmarks" of TraderTraitor.
Politically, however, the attribution is less clear-cut. US President Donald Trump said on Saturday: "We don't know if it's North Korea, but if it is, we'll talk to North Korea about it." Pyongyang has denied state-directed cyber operations for years. North Korea's mission in Geneva and its embassy in China did not respond to media requests.
At USD 6.3 billion, the case surpasses all previous crypto thefts. The FBI likewise attributed the Bybit hack in February 2025, worth around USD 1.5 billion, to TraderTraitor. The current loss is therefore around 4.2 times as large. It also exceeds double the total of all crypto thefts in 2025. Estimates for that year range from USD 2.7 billion to USD 2.9 billion. Additionally, US intelligence agencies estimate North Korea earns at least USD 1 billion a year from crypto hacks and other financial crimes.
