The company said that between 06:00 and 15:30 GMT on November 1 it processed $4.649bn in withdrawals and $1.01bn in deposits, leaving the net outflow of about $3.64bn. Binance also said there was an initial spike in withdrawals that later eased and that flows were stabilising. That stabilisation claim comes from Binance itself, so it deserves the usual caution, but the basic arithmetic does show something useful: customers were not acting in one direction only.
The baseline matters too. Binance said in 2024 that it held more than $160bn in assets in custody. If that remains broadly representative, the outflow is a small fraction of the pile rather than a full-scale evacuation. It is still a blunt measure of confidence after a breach of this size. Users tend to rediscover the appeal of self-custody when an exchange has just spent days explaining how it was compromised.
The bigger fact is the breach itself. BBC reports the incident affected $6.3bn worth of digital assets, with Binance saying it has covered around 95% of the stolen amount and that the rest may take longer to source. The company has repeatedly said it will cover all losses linked to the attack, using channels including its corporate treasury and its futures insurance and emergency reserve funds. It also said last week that it had reserved more than $6.34bn to deal with the fallout.
US authorities have pointed at North Korea. The FBI published cryptocurrency wallet addresses linked to TraderTraitor, also known as the Lazarus Group, and urged industry partners to block transactions involving them. Binance, for its part, said early checks suggest the incident may have begun with a compromised laptop belonging to an engineer, which allowed hackers to make unauthorised transactions.
Binance also said withdrawals for more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, while more services will return in phases once security checks are completed. For the world’s largest crypto exchange, reopening in stages is better than staying shut, but it is still an awkward advertisement for a business that sells speed and permanence.
Alex de Valletta
Dua Mifsud
Isla Camilleri
Sophia Borg