Binance Withdrawals Reach $4.7 Billion After Gradual Resumption Following Hack
Key Facts
Net withdrawals from Binance reached about $4.7 billion by Monday morning in London, after the platform resumed withdrawals in stages following a precautionary suspension lasting about 48 hours after the security breach. A Binance spokesperson said the amount was less than 3% of the platform’s $166 billion in assets. The company estimated the incident’s total impact at about $6.3 billion, without describing that figure as a confirmed final tally of losses. Binance said withdrawals initially rose, then fell and stabilized, while inflows to the platform reached $2.7 billion. The figures put customer confidence at the forefront of the incident’s fallout, with withdrawals remaining gradually available after security checks.
Binance began planning to resume the first phase of withdrawals between 06:00 and 09:00 UTC on 1 November, with available assets and networks to be determined gradually. The company said the suspension of withdrawals allowed it to conduct security checks, assess the incident’s impact and restore affected services. In its 1 November update, it said it had covered about 95% of the affected amount, up from 90% in its previous update. It added that the remaining 5% involved tokens outside the top ten listed assets and with lower liquidity. Binance said it would absorb the impact of the stolen funds using company resources and the SAFU fund, and that it had worked with blockchain network partners to freeze about $3 billion of affected assets on-chain.
Binance said it had raised $6 billion to cover losses from the company treasury, an insurance fund and reserves earmarked for security incidents. This came after the company said its hot wallets were breached at about 20:05 UTC on 29 October, resulting in the loss of an estimated $6.3 billion in tokenized assets. Its preliminary investigation pointed to the possible compromise of a DevOps engineer’s laptop, which enabled the attacker to access a service container and submit unauthorized withdrawal transactions. Binance said it had found no evidence that wallet keys were leaked. The U.S. Federal Bureau of Investigation attributed the attack to the North Korea-backed TraderTraitor group.
As part of efforts to contain funds linked to the incident, Circle said on Monday that it had frozen more than $1.1 billion of USDC linked to the breach. Binance said its partners had helped freeze about $3 billion of affected assets on-chain as of its 30 October update. In the broader market, spot Bitcoin exchange-traded funds recorded $643 million in outflows on Friday, 30 October, their largest daily withdrawals in October. Liquidations of leveraged positions also exceeded $1.3 billion. Bitcoin fell to a six-week low on Friday before recovering over the weekend and trading near $78,000 on Monday, while Ether rebounded from a two-month low.
A Reuters report compared the current flows with about $7 billion withdrawn from USDC over a week after the collapse of Silicon Valley Bank in 2023, and net withdrawals of about $6 billion from Binance over 72 hours following the collapse of FTX in December 2022. Tim Sun of HashKey Group said the incident had not, up to that point, led to widespread panic or a major concentrated wave of withdrawals. Binance says it has more than 335 million users worldwide. The platform’s co-chief executive, Yi He, said the priority was “securing the environment first,” then enabling users to withdraw and resuming Binance operations. The HashKey Group analyst added that security concerns could affect the amount of money market makers, institutions and other investors allocate to cryptocurrencies.
Binance said it was continuing to work with law enforcement and industry partners to track and recover the funds, and that it would publish an incident report after the investigation was complete. The move comes as TRM Labs said hackers linked to North Korea had stolen $7.4 billion through 2 November of 2026. The post-incident report remains the next step Binance has announced for providing further details about the breach. Withdrawals resumed in stages according to the company’s schedule, with assets and networks becoming available gradually. The platform said its goal was to complete the restoration of services after security checks and a review of the incident’s impact.