Binance sees outflows stabilising as exchange returns online after $6.3-billion heist

Binance suffered a massive security breach in which attackers stole $6.3 billion in cryptocurrency. Customers then withdrew $3.64 billion, equal to 2.1% of Binance’s assets. Their actions mattered because withdrawals tested whether users still trusted the world’s largest cryptocurrency exchange after the theft.

The first withdrawal surge followed the attack, but Binance said activity was stabilising and deposits remained substantial. It reported $171 billion in assets under management on October 28 and said it had replaced 95% of the stolen assets. These figures suggested that most customers had not abandoned the platform.

The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored unit, although Donald Trump said North Korea’s involvement remained unclear. Binance said it would cover the financial impact with company funds. Withdrawals were restored in phases, based on demand, while the remaining less liquid assets could take longer to replace.

A cryptocurrency exchange connects buyers and sellers of digital assets. Binance lets users buy, sell and trade cryptocurrencies, including bitcoin, ether and stablecoins. Exchanges matter because customers rely on them to store assets, execute trades and allow withdrawals when they want to move funds elsewhere.

In general, an exchange controls digital wallet addresses that hold cryptocurrency on blockchains. A customer’s account records their claim to assets, while the exchange may move coins between its wallets internally. When a customer withdraws, the exchange sends cryptocurrency to an external blockchain address, creating a transaction that the network records.

The article does not explain Binance’s wallet architecture or custody procedures in detail. It does show the practical pressure exchanges face during a breach: Binance had to restore withdrawals, replace stolen tokens and manage demand from 335 million registered users while reassuring customers that its assets remained available.

The breach was enormous in absolute terms: attackers stole $6.3 billion in cryptocurrency. Customer withdrawals were also substantial at $3.64 billion, but they represented only 2.1% of Binance’s assets. Binance reported total assets under management of $171 billion on October 28, giving scale to the withdrawal figure.

The comparison helped analysts interpret customer behaviour. Ari Redbord of TRM Labs called the withdrawals a precautionary reaction rather than capital flight. Binance also said deposits remained substantial and withdrawals were stabilising after an initial spike. DefiLlama reported a larger outflow figure, $5.81 billion, but Binance said that number omitted deposits into its new hot wallet.

Binance said it had covered 95% of the stolen assets, or about $6 billion, using replacement tokens. The remaining 5% consisted of less liquid assets. Those assets could take longer to source in the required amounts, keeping pressure on the exchange’s liquidity and communication.

Binance used its own resources because it said the company would bear the hack’s financial impact. Replacing stolen cryptocurrency was central to restoring customer access and demonstrating that the exchange could meet withdrawal obligations. The move also supported Binance’s effort to reassure investors after the breach.

The exchange said it had covered about $6 billion, or 95% of the stolen assets, by using company money to buy replacement tokens. It also said money spent on replacement tokens came from its $1 billion Secure Asset Fund for Users, known as SAFU. Binance had set aside around $6.34 billion in company funds to cover losses.

The supplied article does not explain how any insurance funds operated or whether they had already paid claims. It does state that the remaining 5% involved less liquid assets and might take longer to source. Binance therefore faced both a financial cost and a logistical challenge in restoring the stolen asset mix.

If customers keep withdrawing, Binance could face continuing pressure to provide assets quickly while replacing what was stolen. Trust is crucial because an exchange depends on customers leaving funds there. The article describes withdrawal levels as an early test of whether customers still trusted Binance after the attack.

The initial figures were mixed. Customers withdrew $3.64 billion, but Binance said deposits remained substantial and withdrawals were stabilising. The exchange also restored withdrawals in phases and said it had covered 95% of the stolen assets. These steps were intended to show that customer funds and access remained available.

A wider confidence loss could affect cryptocurrency prices and liquidity. The combined market capitalisation of USDT and USDC fell by about $1.2 billion after Friday, a sign that money was leaving cryptocurrencies. The article does not predict a market collapse, but continued withdrawals could increase pressure on exchanges and digital-asset prices.

Phased withdrawals let Binance reopen access gradually instead of processing every token simultaneously. The exchange said it prioritised tokens using data on user demand during the previous week. This mattered because customers wanted different assets, and some stolen tokens were harder to replace than others.

The first phase included 15 tokens, such as bitcoin, ether, some USDC and USDT stablecoins, and dogecoin. Binance said market conditions were stable while it managed the rollout. Its reported replacement effort covered 95% of stolen assets, but the final 5% involved less liquid assets that could take longer to source.

The plan reveals a basic operational challenge: an exchange must match customer demand with available token balances and processing capacity. A phased system can prioritise the most requested assets, but it may delay access to others. It also requires clear communication, because delays can increase anxiety after a security breach.

Cryptocurrencies are digital assets transferred and recorded on blockchain networks. Stablecoins are cryptocurrencies designed to track a steadier reference value, often a traditional currency. The article names bitcoin, ether, USDT and USDC, along with dogecoin. These assets matter because ownership and movement depend on digital records rather than physical coins.

A blockchain transaction moves tokens from one address to another and records the transfer on the network. After the Binance breach, the FBI said attackers converted stolen assets into ether. It expected further laundering through related technology, meaning the funds could be moved through additional addresses or services to make their origin harder to follow.

Blockchains can therefore support both rapid transfers and forensic investigation. US blockchain firms linked the attack to earlier North Korea-attributed incidents. The FBI identified TraderTraitor, a North Korean state-sponsored unit, while Donald Trump said North Korea’s role remained unclear. The article does not explain the exact laundering tools used.