Binance crypto heist: Withdrawals Stabilize After $6.3 Billion Theft

The Binance crypto heist has forced the world’s largest cryptocurrency exchange to restore withdrawals in stages after attackers stole $6.3 billion in digital assets. Binance says customer withdrawals spiked after the breach but have since stabilized, while deposits have remained substantial.

The incident affects Binance’s 335 million registered users and raises a broader question for traders and institutions: how much confidence can an exchange retain after a theft of this scale? According to CNA’s report, customers withdrew $3.64 billion on a net basis, equivalent to 2.1% of Binance’s assets, after services began returning online.

How Binance is restoring withdrawals after the crypto heist

Binance has not described the return of withdrawals as a single completed restart. The exchange said it was using a phased rollout, prioritizing tokens according to user demand observed during the week after the attack. The Binance crypto heist has therefore produced a recovery process that is being managed in stages.

The first phase covered 15 tokens. That group included Bitcoin, Ether, Dogecoin and some tokens involving the USDC and USDT stablecoins. Binance said its approach was intended to match the tokens users were requesting most heavily, and it told customers that market conditions were stable.

That distinction matters because a phased restoration means service availability can vary by asset. The source does not establish that every supported token was immediately available for withdrawal, so the event should be understood as a gradual reopening rather than a fully completed return to normal operations.

What the $3.64 billion outflow figure means

Binance said the $3.64 billion figure represents net customer outflows: assets withdrawn by customers after accounting for deposits made during the same period. The exchange reported $171 billion in total assets under management as of Oct. 28, making the outflow equal to 2.1% of that reported total.

That number is disputed by blockchain analytics platform DefiLlama, which displayed outflows of $5.81 billion, up from an earlier $4.36 billion estimate. Binance did not immediately respond to a request for comment on the revised DefiLlama figure. A Binance spokesperson said the initial estimate did not include funds the company had deposited into a new hot wallet, which the spokesperson said made the figure inaccurate.

The competing figures describe different readings of blockchain movements rather than a settled final count. Binance’s own figure reflects its calculation of customer deposits and withdrawals, while DefiLlama’s dashboard estimate changed as additional wallet activity was assessed. That uncertainty is part of how the Binance crypto heist is being evaluated by customers and market observers.

Binance says it replaced most of the stolen assets

Binance said it had covered 95% of the assets stolen in the Binance crypto heist. In a separate explanation, the exchange said it had covered $6 billion by using its own money to buy replacement tokens. It said the remaining 5% consisted of less liquid assets that could take longer to source.

Those statements describe replacement of assets, not necessarily recovery of the original stolen coins. The source does not say that Binance recovered all of the stolen funds or that every asset was traced and returned by the attackers. That difference is important in cryptocurrency incidents, where replacement, tracing, freezing and recovery are separate outcomes.

Binance’s reported effort is designed to reassure customers that the exchange can meet withdrawal demands despite the theft. The scale of the Binance crypto heist does not remove the underlying security concerns, particularly for users who keep assets on a centralized platform rather than in their own wallets.

Why the Binance crypto heist matters for US readers

The incident has direct relevance for US investors because it tests how institutional capital evaluates cryptocurrency exchange security. Ari Redbord, global head of policy at US blockchain analysis firm TRM Labs, said the event was unsettling for conservative institutional investors and compared an exchange breach with “bank robbery at the speed of the internet.”

The market response showed that the effects extended beyond Binance accounts. Bitcoin reached a six-week low on Friday before recovering slightly to trade above $78,000 on Monday, while Ether fell to a two-month low before recovering to $2,287. The two largest stablecoins, USDT and USDC, lost about $1.2 billion in combined market capitalization after Friday, according to CoinMarketCap.com.

US spot Bitcoin exchange-traded funds recorded $643 million in outflows on Friday, the largest daily outflow of October, while more than $1.3 billion in leveraged positions were liquidated, Redbord said. These figures do not prove that every market move was caused by the Binance crypto heist, but they show how a major exchange failure can quickly affect connected trading products and positions.

Why some customers are keeping Binance accounts

Withdrawal activity is an early measure of customer confidence, but it does not show that every user intends to leave Binance. Jay Koh, vice president at the Asia Web3 AI Association, said he had not withdrawn his Binance holdings because most of his funds were stored in a cold wallet, an offline storage method that was not affected by the hack. His example shows why the Binance crypto heist may affect trading behavior differently from long-term custody.

Koh said users should review their exposure, diversify custody arrangements and avoid keeping more assets on one platform than necessary. That approach separates the question of whether a customer uses Binance for trading from the question of where that customer stores long-term holdings.

For example, a trader might keep only the assets needed for near-term transactions on an exchange and hold other funds in a cold wallet. That is a hypothetical illustration of the custody distinction; the source does not provide a survey showing how widely Binance customers are adopting it.

What is known about the TraderTraitor attribution

The FBI said the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack. The agency said law enforcement observed members of the unit converting stolen assets into Ether and expected further laundering through related technology. The attribution adds another dimension to the Binance crypto heist beyond the exchange’s operational response.

US blockchain analysis firms TRM Labs and Chainalysis also pointed to North Korean involvement, citing similarities with previous attacks and the fact that most of the theft unfolded in about 20 minutes. However, attribution is not presented as universally settled: US President Donald Trump said it remained unclear whether North Korea was involved. North Korea has denied using state-linked cyber units for espionage, financial theft and revenue generation, and its mission in Geneva and embassy in China did not respond to requests for comment.

The Binance crypto heist therefore leaves two separate questions. Binance says it has covered most of the stolen value and is managing withdrawals in phases; investigators attribute the attack to TraderTraitor, while a competing public assessment remains on the record. For customers and institutions, the immediate practical lesson is that exchange access, asset custody and confidence can change faster than traditional financial controls are designed to handle.

Source: CNA

Binance crypto heist: frequently asked questions

More from VaidikX

Business & StartupsWonderful Raises $550M at $5B Valuation to Build an Enterprise AI Operating SystemBusiness & StartupsiPhone Duo review: Why Apple’s Foldable Won Over After a Five-Day TripBusiness & StartupsMicrosoft voluntary exit offer opens to about 60,000 employees in four countries

Get the VaidikX AI Brief: the week’s biggest AI, Big Tech and startup news, explained in 5 minutes. Subscribe free.