In brief
Following a $6.3 billion hack attributed to North Korean hackers, Binance reopened withdrawals on November 1, causing a $3.64 billion net outflow from its customers. The exchange’s proof‑of‑reserves shows the outflow was 2.1% of its $171 billion in assets, and Binance has announced it will cover 95% of the lost funds.
In the days after a record $6.3 billion theft, the world’s largest cryptocurrency exchange, Binance, announced a $3.64 billion net outflow of customer funds. The figure represents the difference between withdrawals and deposits recorded between 0600 and 1530 GMT on November 1, as Binance gradually lifted its service shutdown. The move comes as the platform’s security team re‑enabled withdrawal functionality following investigations that identified a North Korean hacking operation known as TraderTraitor.
Binance’s proof‑of‑reserves data, released on October 28, indicates the exchange held $171 billion in total assets. The net outflow amounted to about 2.1% of that total. Over the vaccination period, the firm processed $4.65 billion in withdrawals and received $1.01 billion in deposits. The sharp rise in withdrawal volume surprised Binance’s own estimates, which had projected a more gradual outflow as investors tested the network’s security posture.
Background: The $6.3 Billion Hack
On the previous week, Binance’s security team detected unauthorized transfers totaling $6.3 billion across 18 blockchain assets. The FBI, identifying the culprit group as North Korean hackers, named the operation TraderTraitor. The breach occurred when an attacker bypassed multi‑factor authentication on a cold‑storage wallet that held a small‑to‑medium‑size reserve of tokens used for settlement and liquidity provisioning.
Following the discovery, Binance temporarily suspended all withdrawal services across its fifteen supported networks and assets. The company also filed a notice with regulatory bodies in Singapore and Malta, and it began an internal audit to confirm the extent of the damage. Binance’s official statements emphasize that the hack did not compromise the long‑term security of its core infrastructure, which stores the majority of user funds in segregated, off‑chain vaults.
During the suspension, Binance communicated with its user base via social media and its official Discord channel. The exchange noted that 95% of the stolen funds would be reimbursed, a figure that rose from 90% in an earlier estimate. The remaining 5% consists of less liquid tokens that are difficult to source in the amounts needed for a full restitution.
Binance’s response strategy offset the cost of the hack against its insurance policies and earned‑back reserves. By absorbing the majority of the financial loss, the firm aims to maintain user confidence and to avoid a cascade of panic withdrawals that could destabilize liquidity on the exchange.
Immediately after the reversal of services, Binance’s risk‑management team began a phased restoration of withdrawals. Initial re‑enablement covered only a core set of assets on key networks, with a full roll‑out to all fifteen networks slated for completion by 1236 GMT that same day. Binance continued to monitor transaction flows, testing remaining networks for anomalies before expanding withdrawal capacity.
The user‑side reaction to the resumed withdrawals has been mixed. While some participants patiently waited for the official settlement of their claims, others rushed to transfer holdings off the platform, triggered by concerns over potential secondary attacks. Binance’s net outflow figure captures this tension: a substantial exodus that still dwarfs the company’s deposits, despite the cumulative $1.01 billion injected by customers during the same window.
Financial analysts note that the net outflow, at $3.64 billion, represents a significant shock to the exchange’s liquidity. Yet, when benchmarked against its asset base, it is a comparatively small fraction. The key question for market watchers moving forward is how Binance will sustain liquidity operations while attracting stable deposits, given the reputational impact of a hack that remains among the largest in crypto history.
In the longer term, the Binance incident underlines the necessity for robust multi‑layered security protocols and independent verification of reserve holdings. The exchange’s own proof‑of‑reserves approach, while reassuring, depends heavily on transparent audit processes and real‑time reporting. As the broader digital‑asset ecosystem evolves, the interplay between regulatory oversight and technological safeguards will continue to shape the resilience of major trading platforms.
