Customers of Binance moved billions of dollars off the exchange within hours of withdrawal services reopening, in a rush that showed how quickly confidence can drain away even after a company says it has covered a huge loss. The withdrawals followed one of the largest cryptocurrency thefts ever reported, and they came despite Binance announcing that it had already replaced most of the stolen funds from its own resources.
Binance Customers Withdraw Billions Within Hours
Binance began restoring withdrawal services at 6 a.m. UTC on November 1, after suspending them following the October 29 cyberattack. Between 6 a.m. and 3:30 p.m. UTC that day, customers withdrew approximately 4.65 billion dollars in cryptocurrency and other assets. During the same period, the exchange received 1.01 billion dollars in deposits, leaving net outflows of 3.64 billion dollars, the difference between money leaving an exchange and money coming in.
Binance said the amount withdrawn represented approximately 2.1 percent of its 171 billion dollars in total assets, based on its October 28 proof-of-reserves figures. That puts the outflow in proportion: most customer assets stayed where they were. Even so, a withdrawal of several billion dollars in a single day is not routine, and most of it happened in the first few hours after services resumed, when the most worried customers act first. By 12:36 p.m. UTC, Binance had restored withdrawals across all 15 networks and assets in the initial reopening phase, while work on other networks continued.
Binance Says Most of the Stolen Assets Have Been Replaced
The withdrawals followed a major cyberattack on October 29, when hackers stole approximately 6.3 billion dollars in cryptocurrency from Binance’s online wallets. The breach forced the exchange to suspend withdrawals while it investigated and strengthened its security systems.
On October 31, Binance announced that it had replenished approximately 90 percent of the stolen assets using its own resources, drawing on its corporate treasury, its Secure Asset Fund for Users, known as SAFU, and its futures insurance fund. Those funds exist for this kind of emergency, to absorb losses so customers do not have to. Binance said major cryptocurrencies, including Bitcoin, Ethereum, BNB, Solana, XRP and several stablecoins, were fully backed by reserves, while the rest were mostly less widely traded coins that could take longer to replace. It has promised to cover the entire loss rather than pass it on to customers.
That promise is central, yet covering a loss on paper is not the same as restoring trust in practice. Customers may still move funds to cold storage or another platform, not because they believe the money is gone, but because they want control of it themselves after a shock.
Binance Founder Tries to Reassure Customers
Following the withdrawals, Binance founder and former chief executive Changpeng Zhao tried to reassure users about the exchange’s financial position. In a post on X, Zhao said that 98 percent of customers’ assets remained on the platform, and noted that most withdrawals occurred shortly after services resumed. Binance separately stated that withdrawal volumes had fallen from their initial peak and were becoming more stable, while deposit activity remained strong despite the security concerns.
A founder’s reassurance carries weight with loyal users, but it has limits, and customers will judge the exchange more by what happens next than by what is said in the first days. The figures Binance released are meant to show that the platform is still functioning normally. Whether users accept that picture will become clearer as withdrawal and deposit figures settle into a steadier pattern.
Hack Linked to North Korean Group
The United States Federal Bureau of Investigation has attributed the 6.3 billion dollar theft to TraderTraitor, a hacking group linked to North Korea. The attack is among the largest cryptocurrency thefts ever reported. Binance has said it is working with security investigators and other industry partners to recover stolen funds and prevent further losses, and it is preparing updated proof-of-reserves information so customers can check the assets backing their holdings.
That update will be closely watched, because proof of reserves lets an exchange demonstrate that it holds the assets it says it holds for customers. After a breach of this size, users and regulators will want fresh figures rather than numbers from before the attack. Recovery of stolen cryptocurrency is often slow and partial, since stolen funds are usually moved through many wallets, but even partial recovery would reduce the final bill.
Although Binance says it has enough funds to cover the theft, the billions withdrawn after reopening show that the breach has damaged customer confidence in a way a balance sheet alone cannot fix. The company must now restore its services fully while convincing users their funds remain secure, with updated figures and a clear account of what has changed. If withdrawals keep easing, the episode may be remembered as a severe but survivable shock. If outflows pick up again, it will become a longer test of whether the world’s largest cryptocurrency exchange can rebuild the trust its business depends on.
