Binance's tracked assets rose by $3.4 billion in the two days after the exchange restarted withdrawals following a $6.3 billion hot wallet breach, according to the company's data. The rebound came after initial net outflows of approximately $3.64 billion when withdrawals first resumed.
Attack and immediate response
The attack occurred on October 29, 2026, at approximately 20:05 UTC, when attackers exploited weaknesses in Binance's hot wallets and drained tokens across multiple blockchains in about 20 minutes. The breach has been attributed to TraderTraitor, a group linked to North Korea.
Binance froze all withdrawals immediately after the attack and set aside more than $6.34 billion in corporate resources to cover the losses in full. Part of the funds came from its SAFU reserve, an emergency fund, and part from its futures insurance fund.
By October 31, Binance had replenished approximately 90% of the affected assets, mostly through large token purchases on the open market and over-the-counter deals. That figure was later updated to about 95%. Partners also froze roughly $3 billion of stolen assets tied to the hack, limiting how much the attackers could move or cash out.
Binance published a fresh proof-of-reserves snapshot taken at 00:00 UTC on October 31, stating that it confirmed its major assets were fully backed.
Outflows then a rebound
Withdrawals resumed on November 1, 2026, rolled out in phases across more than 15 networks. Initial net outflows came to around $3.64 billion, equal to roughly 2.1% of Binance's total assets under management, which stand at approximately $171 billion.
Binance's tracked assets then climbed by $3.4 billion over the two days following the withdrawal restart. The gain lands close to the initial outflows, though the exchange did not quite return to its starting level.
A caveat is that tracked asset figures do not separate fresh customer deposits from other movements on the balance sheet. Binance was actively buying tokens to replenish what was stolen, and that buying could account for part of the increase.
Why this hack is different
At roughly $6.3 billion, the breach marks the largest hack in crypto history. Many past exchange hacks ended with frozen accounts, socialized losses, or bankruptcy filings. Binance chose to absorb the entire hit with its own money and said customer assets remained intact. That approach requires deep reserves on hand, and setting aside more than $6.34 billion on short notice is a capacity few platforms in the industry could match.
What to watch
For Binance, the two-day rebound is the most important data point since the attack. Covering losses is a balance sheet problem; keeping customers is a trust problem. The $3.4 billion increase suggests progress on the second, even if part of that number reflects its own replenishment buying.
The initial $3.64 billion outflow still matters, but roughly 2.1% of assets heading for the door within the first phase of reopening is manageable for Binance. The North Korea link adds a geopolitical layer; if the attribution to TraderTraitor holds, the roughly $3 billion frozen by partners is a key battleground.
The things to watch next are whether the replenishment figure moves from about 95% to full coverage, whether net flows stay positive as all 15-plus networks return to normal operation, and whether Binance publishes follow-up proof-of-reserves snapshots to confirm the October 31 picture holds.
