Users moved funds off the exchange quickly once withdrawals resumed following the October hot wallet breach
Users pulled nearly $3.8 billion off Binance in roughly 10 hours.
The outflow came after Binance began a phased restart of withdrawals on November 1, 2026. Withdrawals had been frozen since an October 29 security breach that drained approximately $6.3 billion from the exchange’s hot wallets.
What happened at Binance
On October 29, attackers emptied Binance hot wallets of approximately $6.3 billion. The incident is widely seen as the largest theft in crypto history.
A quick primer: a hot wallet is connected to the internet so an exchange can process withdrawals quickly. A cold wallet stays offline. Hot wallets offer convenience, but that connectivity is also what makes them a target.
Binance paused all withdrawals the same day. It then worked to freeze nearly $3 billion of the affected assets, partnering with stablecoin issuers Tether and Circle on recovery efforts.
That partnership matters because stablecoin issuers can freeze tokens at the contract level. When stolen funds are held in a stablecoin, the issuer can effectively lock that money in place.
The breach was traced to a compromised laptop belonging to a DevOps engineer. There was no leakage of private keys, according to the account of the incident.
Deposits stayed active and unaffected throughout the incident, Binance confirmed.
The reopening and the rush
When withdrawals came back on November 1, Binance put the biggest assets first. Bitcoin, Ethereum, USDT, USDC and BNB were among the first tokens made available.
Users responded quickly. Within about ten hours of the reopening, withdrawals totaled between $3.8 billion and $4 billion, according to the research findings, with the original report putting the figure at nearly $3.8 billion.
Binance has pledged to cover the losses itself. The exchange said it would draw on its Secure Asset Fund for Users (SAFU), its futures insurance and its corporate treasury, with no costs passed on to customers.
The exchange said it had replenished around 95% of the affected assets by early November. It also plans to publish an updated Proof of Reserves to help restore customer confidence.
The North Korea connection
The FBI and blockchain analytics firms have linked the attack to TraderTraitor, a hacking group from North Korea.
The same group was previously tied to the February 2025 Bybit breach, which saw around $1.5 billion stolen. At the time, that was a staggering figure. The Binance incident is roughly four times larger.
What this means for Binance and the market
On one hand, Binance processed billions in outflows within hours of reopening. Its claim of roughly 95% replenishment gives that ability some context.
On the other hand, nearly $3.8 billion leaving in ten hours shows that trust took a real hit. The research describes the market reaction as volatile, with the outflow reflecting ongoing trust issues.
The next markers to watch are the updated Proof of Reserves, whether the remaining frozen assets are recovered, and whether outflows slow over the coming days.
