Binance Customers Withdraw Billions After Massive Security Breach

Binance Customers Withdraw Billions Following Security Breach

Binance customers withdrew $4.65 billion in cryptocurrency and other assets within hours of the exchange reopening withdrawals following a massive $6.3 billion security breach. The cryptocurrency exchange recorded $3.64 billion in net outflows on Sunday, November 1, as customers rushed to move their funds following the attack. The withdrawals came despite Binance announcing that it had replenished approximately 90% of the assets stolen during the breach. According to the company, withdrawal activity has started to stabilize after an initial surge, while deposits remain substantial.

Binance began restoring withdrawal services at 6 a.m. UTC on November 1, after temporarily suspending them following the October 29 cyberattack. Between 6 a.m. and 3:30 p.m. UTC, customers withdrew approximately $4.65 billion from the platform. During the same period, Binance received $1.01 billion in deposits, resulting in net outflows of $3.64 billion. Net outflows represent the difference between money leaving an exchange and money entering it. According to Binance, the amount represented approximately 2.1% of its $171 billion in total assets, based on its October 28 proof-of-reserves figures.

The company said most withdrawals occurred during the first few hours after services resumed. By 12:36 p.m. UTC, Binance had restored withdrawals across all 15 networks and assets included in the initial reopening phase. Testing and restoration work continued for other supported networks and assets. The rapid pace of withdrawals highlighted immediate user anxiety regarding platform security and fund safety.

How Binance Replaced Stolen Cryptocurrency Assets

The withdrawals followed a major cyberattack on October 29, when hackers stole approximately $6.3 billion in cryptocurrency from Binance's online wallets. The breach forced the exchange to temporarily suspend withdrawals while it investigated the incident and strengthened its security systems. On October 31, Binance announced that it had replenished approximately 90% of the stolen assets using its own financial resources. The company used funds from its corporate treasury, Secure Asset Fund for Users (SAFU), and futures insurance fund to cover the losses.

Binance said major cryptocurrencies, including Bitcoin, Ethereum, BNB, Solana, XRP, and several stablecoins, were fully backed by reserves. The remaining assets were mostly less widely traded cryptocurrencies, which could take longer to replace. Binance has promised to cover the entire financial loss rather than pass it on to customers. This strategy aims to absorb the financial shock internally without impacting individual user balances.

The Secure Asset Fund for Users acts as an emergency insurance buffer established by the platform to protect users in extreme security scenarios. Depleting these internal reserves demonstrates the severity of the October 29 incident. Financial analysts and industry observers closely monitored how the exchange would manage the shortfall without halting operations entirely.

Binance Leadership Responds to Market Concerns

Following the large withdrawals, Binance founder and former CEO Changpeng Zhao attempted to reassure users about the exchange's financial position. In a post on X, Zhao said that 98% of customers' assets remained on the platform. He also noted that most of the withdrawals occurred shortly after services resumed. Binance separately stated that withdrawal volumes had declined from their initial peak and were becoming more stable. The company said deposit activity remained strong despite the security concerns.

Communication from senior leadership plays a vital role during liquidity events and post-hack recovery periods. By sharing specific percentages of remaining user funds, executives attempt to prevent panic-driven runs on the exchange. Maintaining operational transparency helps rebuild trust among retail and institutional traders alike.

Despite these reassurances, the sheer volume of capital leaving the platform indicates persistent caution in the digital asset market. Users often prefer to hold their keys in private wallets rather than risk keeping funds on centralized exchanges after a major exploit.

Investigation Links Hack to North Korean Group

The US Federal Bureau of Investigation (FBI) has attributed the $6.3 billion cryptocurrency theft to TraderTraitor, a hacking group linked to North Korea. The attack is among the largest cryptocurrency thefts ever reported. Binance has said it is working with security investigators and other industry partners to recover stolen funds and prevent further losses. The exchange is also preparing updated proof-of-reserves information to allow customers to check the assets backing their holdings.

Attributions to state-sponsored hacking organizations highlight the escalating sophistication of cyber threats facing financial technology platforms. Security agencies track illicit fund movements across blockchain networks to freeze stolen assets before attackers can launder them through decentralized mixing services. Exchanges coordinate globally with law enforcement to flag suspicious wallet addresses associated with known threat actors.

Although Binance says it has enough funds to cover the theft, the billions withdrawn after the platform reopened show that the breach has affected customer confidence. The company will now need to restore its services fully while convincing users that their funds remain secure. Long-term recovery depends on consistent security audits and transparent reporting of reserve assets.