Binance Resumes Withdrawals Amidst Significant Outflows and Asset Recovery Efforts

Binance resumed withdrawal services on November 1st, following a temporary freeze of approximately 45 hours due to a security incident. In the 24 hours after withdrawals were reinstated, the exchange experienced on-chain outflows exceeding $6.1 billion, which represented about 3.6% of its total assets prior to the incident. Binance reported a net outflow of $3.64 billion during the first 9.5 hours of resumed operations, after which activity reportedly stabilized with significant deposits.

Competitor exchanges OKX and Bybit saw net inflows during the same period, with OKX recording approximately $450 million and Bybit approximately $134 million. These figures suggest continued trading activity within the broader cryptocurrency market, rather than a complete user exit. However, it is noted that aggregated on-chain data may include internal wallet transfers, and DefiLlama’s statistics might not exclusively reflect customer withdrawals.

Binance has stated that losses from the incident, estimated at approximately $6.3 billion in crypto assets moved from a hot wallet on October 29th, will be covered by the company and its SAFU (Secure Asset Fund for Users) fund, not by individual users. The exchange also reported that 95% of the affected assets have been recovered or are in the process of being bought back, leaving an estimated 5% yet to be accounted for.

In parallel, law enforcement actions are underway. The FBI has attributed the hack to North Korea, identifying the operation as ‘TraderTraitor’. In cooperation with law enforcement, Circle reported it had frozen over $1.1 billion in USDC linked to the incident. This action highlights the increasing collaboration between stablecoin issuers and authorities in tracking and freezing illicit cryptocurrency flows.

While Binance’s ability to manage significant outflows and its commitment to covering losses demonstrate a degree of operational and financial resilience, the event underscores the inherent risks associated with holding assets on centralized exchanges. The incident also brings to light the importance of user vigilance, diversification of holdings, and the potential benefits of self-custody for managing liquidity risks, especially during periods of withdrawal suspension. The full recovery of the remaining 5% of stolen assets and the specific methods employed by the hackers remain points of uncertainty.

Why This Matters

This event is significant as it tests Binance’s solvency and operational resilience following a major security incident. The FBI’s attribution of the hack to North Korea and Circle’s cooperation in freezing funds highlight the evolving landscape of cybercrime and law enforcement’s increasing involvement in tracking illicit cryptocurrency flows. The substantial outflows, while managed by Binance, underscore the inherent risks users face when holding assets on centralized platforms, emphasizing the importance of user vigilance and self-custody.

Broader Context

Binance announced on November 1st that withdrawals were resumed. The FBI attributed the hack to North Korea, identifying the operation as ‘TraderTraitor’. Circle reported it had frozen over $1.1 billion in USDC linked to the incident. These actions demonstrate the interconnectedness of the crypto market with global financial systems and law enforcement efforts.