Following the October 29 hacking attack, a net $5.28 billion flowed out of Binance, according to data published on Tuesday, November 3, by the exchange and its CEO Richard Teng. Binance says the outflow is slowing and that hourly deposits have begun to exceed withdrawals.
According to CoinDesk, within 46 hours of the attack customers withdrew a total of $10.97 billion from the exchange. After deducting deposits, this gives a net outflow of $5.28 billion. The data comes from on-chain analyses shared by Richard Teng, and the summary itself was published by Binance’s account on X.
The exchange points to 03:00 UTC on Tuesday (04:00 Polish time). According to its post, hourly deposits exceeded withdrawals at that time.
Peak panic on Sunday
According to CoinDesk, withdrawal pressure was greatest on November 1. In the peak hour, withdrawals exceeded deposits by $936 million, and the total value of withdrawals within one hour reached $1.24 billion. The pace of outflows later slowed. Between November 1 and early morning on November 3, deposits totalled $5.69 billion.
On Tuesday morning, the hourly surplus of deposits over withdrawals was around $10 million. However, the cumulative net outflow still stood at $5.28 billion. Teng wrote on X that the trend is starting to show more inflows, because hourly deposits now exceed withdrawals.
CoinDesk notes that the $6.4 billion stolen is a separate amount. Not all withdrawals can be attributed to customers reacting to the hack. The summary does not distinguish the reasons for withdrawals.
Where the funds went
Binance founder Changpeng Zhao (CZ) wrote on X on Tuesday that, according to public reports, only 6–10% of withdrawals went to other centralised exchanges. Most, he said, was supposed to have gone to private wallets that, in his assessment, have not yet interacted with decentralised exchanges. This is his assessment, not exchange data.
Earlier, CZ wrote that Binance covered the losses from its own balance sheet: it did not borrow money, sell assets or raise capital. We also reported that the exchange covered about 90% of the losses. According to Binance’s posts from November 3, withdrawals are being restored in stages, after security checks are completed. Additional assets on the Ethereum network have been unlocked, including LINK, SHIB and ONDO, among others.
Background: the attack and attribution
The FBI attributed the October 29 attack to the North Korean group TraderTraitor. We wrote about this in our article on the FBI’s appeal to the industry for address blocks. According to CoinDesk, North Korea denies involvement in the hack. We described the beginnings of the case when Binance began investigating a possible attack.
What it means for users in Poland
For Binance customers, the key point is the gradual restoration of withdrawals: not all assets and networks are yet available, and the exchange has announced further stages. Balances are to be covered from the exchange’s own funds. Outflow data does not mean customer losses, only capital flows. After such incidents, the number of fake messages and links grows, so look for information only on Binance’s official channels and never share your passwords or codes with anyone.
