Binance customers pulled a net $3.64 billion from the cryptocurrency exchange on November 1, 2026, after withdrawals resumed following a record $6.3 billion cyberattack. The rapid outflows tested customer confidence, even as the company pledged to replace stolen assets and US investigators identified North Korean-linked hackers as responsible.
Key Overview
- $6.3 billion in crypto assets was stolen from Binance hot wallets on October 29.
- $4.649 billion in withdrawals and $1.01 billion in deposits produced $3.64 billion in net outflows on November 1.
- Net withdrawals represented approximately 2.1% of Binance’s reported $171 billion in assets before the reopening.
- The FBI attributed the attack to North Korea’s TraderTraitor operation on October 31.
- Binance says it will absorb customers’ losses, while investigators continue tracking stolen assets.
Withdrawals Surge as Binance Restores Trading Access
Binance began reopening withdrawals in phases at 06:00 UTC on November 1, three days after hackers compromised its internet-connected wallets. The exchange initially restored access across 15 networks and assets, with other services subject to further security checks.
Between 06:00 and 15:30 UTC, customers withdrew $4.649 billion and deposited $1.01 billion, creating a net outflow of approximately $3.64 billion. The withdrawal figures equalled about 2.1% of the $171 billion in exchange assets reported in its October 28 proof-of-reserves snapshot.
The company said withdrawal activity spiked immediately after reopening but subsequently eased. The difference between gross withdrawals and net outflows matters: substantial deposits continued despite the disruption. Nevertheless, the movement highlighted the speed at which digital-asset customers can transfer holdings during a crisis.
Context is everything. Stay ahead of shifting trends with today’s market updates, and uncover emerging opportunities using the Serrari Group Market Index and Marketplace. Then, take control of your own financial future by exploring our Money & Life Reset Transformation Blueprint ™ to build stronger habits, create better systems, and design a path toward lasting wealth.
FBI Links Record Theft to North Korean Hackers
The cyberattack occurred on October 29 and affected roughly $6.3 billion in assets held in Binance hot wallets. In an October 31 security alert, the FBI attributed the theft to North Korea’s TraderTraitor operation and urged crypto businesses to block transactions involving identified wallets.
The agency said investigators observed attackers converting stolen assets primarily into Ether and anticipated further laundering through decentralised-finance platforms and instant-swap services. TraderTraitor has also been linked to the $1.5 billion Bybit theft in February 2025, underscoring the scale of attacks targeting major exchanges.
Binance’s preliminary investigation pointed to a compromised engineer’s laptop but later uncovered additional possible breach points. In its October 30 incident update, the exchange said it had found no evidence that wallet private keys had leaked. The full attack sequence remains under investigation.
Customer Reimbursement and Stolen-Fund Recovery
Binance pledged to cover losses through its corporate treasury and Secure Asset Fund for Users. By November 1, the exchange reported that it had covered approximately 95% of the affected assets, while sourcing less-liquid tokens needed to replace the remainder.
Separately, blockchain monitoring and issuer interventions have frozen billions of dollars linked to the theft. These frozen assets should not be confused with the exchange’s own replacement funding: a freeze can prevent transfers without meaning the assets have been returned to Binance or its customers.
The broader challenge is recovering funds still under attackers’ control. A November 2 blockchain investigation estimated that about $2.7 billion had been frozen and roughly $3 billion remained in attacker-controlled wallets at the time of its analysis. Those estimates can change as transactions and enforcement actions develop.
What the Hack Means for Crypto Investors
The incident raises fresh questions over exchange custody controls, employee-device security and how quickly platforms can restore operations after a major breach. Although Binance’s reported net outflows were a relatively small share of its stated assets, the sudden rush to withdraw demonstrated the importance of accessible reserves and timely communication.
For customers, reimbursement commitments do not eliminate operational risk. Investors should verify service-restoration notices through official channels, be cautious of impersonators offering recovery assistance and review their own custody and account-security practices while the investigation continues.
Sources: Binance / Federal Bureau of Investigation / The Block / TechCrunch / Associated Press / BleepingComputer / Bitquery
Your financial future isn’t something you wait for—it’s something you build.
The real question is: when do you begin?
Move beyond simply staying informed.
Navigate the markets with clarity—track trends through the Serrari Group Market Index, uncover opportunities in the Serrari Marketplace, and build practical knowledge with our Curated Wealth Builder Platform.
Stay connected to what truly matters.
Get daily insights on macro trends and financial movements across Kenya, Africa, and global markets—delivered through the Serrari Newsletter.
Growth opens doors.
Advance your career through professional programs including ACCA, HESI A2, ATI TEAS 7 , HESI EXIT , NCLEX – RN and NCLEX – PN, Financial Literacy!🌟—designed to move you forward with confidence.
See where money is flowing—clearly and in real time.
Track Money Market Funds, Treasury Bills, Treasury Bonds, Green Bonds, and Fixed Deposits, alongside global and African indexes, key economic indicators, and the evolving Crypto and stablecoin landscape—all within Serrari’s Market Index.
