- Binance recorded $10.97 billion in customer withdrawals over 46 hours after reopening services, with net outflows reaching $5.28 billion
- The exchange says it has replenished approximately 95 percent of the affected assets using its emergency protection fund and corporate resources
- North Korea has rejected the FBI's attribution of the theft to its TraderTraitor hacking operation
Binance has faced nearly $11 billion in customer withdrawals following a $6.3 billion cryptocurrency theft, putting the world's largest crypto exchange under pressure to reassure investors about the safety of their assets.
Figures shared by Binance co-CEO Richard Teng showed that customers withdrew $10.97 billion in cryptocurrency between November 1 and early November 3. Deposits during the same 46-hour period totaled approximately $5.69 billion, leaving net outflows of around $5.28 billion.
The withdrawal surge followed the exchange's decision to resume services after suspending withdrawals for more than two days following the October 29 security breach.
At its peak, withdrawals exceeded deposits by $936 million in a single hour, highlighting the immediate reaction from customers when access to their funds was restored.
The outflows represented approximately 3.1 percent of the $171 billion in assets Binance had previously reported on its platform. The figures do not mean the exchange lost $10.97 billion, as a substantial portion of the withdrawn assets was offset by new deposits.
The initial withdrawal pressure has since eased. By early November 3, hourly deposits had begun exceeding withdrawals, although cumulative net outflows remained substantial.
Speaking at Hong Kong Fintech Week on November 3, Teng said customer inflows and outflows had largely returned to normal and described Binance as being in "very strong financial health."
The exchange has also pledged to cover customer losses resulting from the breach.
How much of the stolen cryptocurrency has Binance replaced?
Binance said it had replenished approximately 95 percent of the affected assets using its own resources, including its Secure Asset Fund for Users (SAFU), an emergency protection fund designed to cover customer losses.
The remaining 5 percent consists primarily of less-liquid tokens that require additional purchases through market and over-the-counter channels.
Teng said the company had sufficient financial resources to absorb the losses and that customer funds remained protected. He also promised a detailed post-incident report once the investigation is complete.
However, replacing the affected assets is different from recovering the original cryptocurrency stolen by the attackers. Binance's commitment means it intends to cover customer losses using its own resources, regardless of whether investigators can retrieve the stolen funds.
The exchange has also published proof-of-reserves information for major cryptocurrencies, including Bitcoin, Ether, USDT, BNB, USDC and Solana, showing at least one-to-one backing for those assets.
Its latest verification was based on an October 31 reserve snapshot, which predates the bulk of the withdrawals following the reopening of services. As a result, it does not independently establish the exchange's reserve position after the subsequent outflows.
Binance has planned another reserve snapshot for November 4, covering additional tokens, alongside updated verification calculations.
The exchange has also expanded withdrawal availability across more assets and blockchain networks, although access has been restored progressively, with some transactions subject to security checks and processing delays.
Why is North Korea denying involvement in the Binance hack?
The Federal Bureau of Investigation (FBI) attributed the October 29 theft to North Korea's TraderTraitor hacking operation, a group associated with state-backed cyber activities.
The agency said the attackers stole more than $6 billion in cryptocurrency from Binance and subsequently began moving the assets through different blockchain networks and services.
Investigators have described the movement of the stolen funds as complex, involving cryptocurrency conversions, cross-chain transfers and intermediary wallets. These methods can make it harder for authorities and blockchain investigators to trace and freeze assets.
North Korea has rejected the allegations. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, described the FBI's claims as "absurd rhetoric" in a statement carried by state news agency KCNA.
She accused Washington of using the incident to portray North Korea as responsible for international cybercrime. The denial has not changed the FBI's attribution, and no judicial finding establishing responsibility has been reported.
The FBI, alongside the US Secret Service and IRS Criminal Investigation, has urged cryptocurrency exchanges, blockchain infrastructure operators and decentralized finance services to block transactions involving addresses associated with the stolen funds.
Efforts to freeze the assets could influence how much of the stolen cryptocurrency can eventually be recovered. However, replacing customer balances does not mean the original funds have been retrieved from the attackers.
The incident has also raised broader questions about the security of cryptocurrency exchanges and the risks associated with holding digital assets on centralized platforms.
Binance has launched a customer appreciation campaign running through November 21, offering eligible users trading-fee rebates, volume-based rewards and promotional yields on selected products as it attempts to rebuild confidence.
The exchange's next steps include completing the remaining asset replenishment, publishing its updated reserve information and releasing a technical post-mortem of the breach.
For Binance, the challenge now extends beyond restoring access to customer accounts. The exchange will need to demonstrate that its security systems have been strengthened and that the safeguards protecting customer assets can withstand future attacks.
