Binance tracked assets climb $3.4 billion in two days after post-hack withdrawal restart

Binance

The exchange's balances rebounded quickly after a $6.3 billion hot wallet breach and a wave of initial outflows

Wed 4 Nov 2026 · 20:37 EST · 4 min read

In Crypto

Binance just had the worst week an exchange can have. Its tracked assets then rose by $3.4 billion in the two days after withdrawals came back online.

That rebound follows a hot wallet breach that drained roughly $6.3 billion in tokens. It is the clearest early signal of whether users trust the world’s largest crypto exchange after the biggest hack the industry has seen.

From a 20-minute drain to a phased reopening

The attack hit on October 29, 2026, at approximately 20:05 UTC. Attackers exploited weaknesses in Binance’s hot wallets and pulled tokens across multiple blockchains in about 20 minutes.

The breach has been attributed to TraderTraitor, a group linked to North Korea.

Binance froze all withdrawals right after the attack. It then set aside more than $6.34 billion in corporate resources to cover the losses in full. Part of that money came from its SAFU reserve, an emergency fund built for exactly this situation, and part came from its futures insurance fund.

The recovery moved fast. By October 31, Binance had replenished approximately 90% of the affected assets, mostly through large token purchases on the open market and over-the-counter deals. That figure was later updated to about 95%.

Outside help mattered too. Partners froze roughly $3 billion of stolen assets tied to the hack, which limited how much the attackers could actually move or cash out.

Binance also published a fresh proof-of-reserves snapshot taken at 00:00 UTC on October 31. The exchange said the snapshot confirmed its major assets were fully backed.

Outflows first, then a $3.4 billion bounce

Withdrawals resumed on November 1, 2026, rolled out in phases across more than 15 networks.

The news moving money, markets, and the world—before your day starts.

Daily. Free. Join 34,000+ readers across crypto, finance, and policy.

We respect your privacy. Unsubscribe anytime.

Users did what users do after a hack. Initial net outflows came to around $3.64 billion.

That sounds like a lot, and it is. In context, it equals roughly 2.1% of Binance’s total assets under management, which stand at approximately $171 billion.

Then the number reversed. Binance’s tracked assets climbed by $3.4 billion over the two days following the withdrawal restart.

Set side by side, the $3.4 billion gain lands close to the $3.64 billion in initial outflows. The exchange did not quite return to where it started, but it got near enough to change the story from flight to recovery.

One caveat is worth keeping in mind. A tracked asset figure does not separate fresh customer deposits from other movements on the balance sheet. Binance was actively buying tokens to replenish what was stolen, and that buying could account for part of the increase.

Why this hack is different

Exchange hacks are not new. What sets this one apart is scale. At roughly $6.3 billion, the breach marks the largest hack in crypto history.

The response is also unusual. Many past exchange hacks ended with frozen accounts, socialized losses, or bankruptcy filings. Binance chose to absorb the entire hit with its own money and said customer assets remained intact.

That approach only works if an exchange has deep reserves on hand. Setting aside more than $6.34 billion on short notice is a capacity few platforms in the industry could match.

What this means for Binance and the broader market

For Binance, the two-day rebound is the most important data point since the attack. Covering losses is a balance sheet problem. Keeping customers is a trust problem. The $3.4 billion increase suggests the exchange is making progress on the second, even if part of that number reflects its own replenishment buying.

The initial $3.64 billion outflow still matters. Roughly 2.1% of assets heading for the door within the first phase of reopening is manageable for Binance.

The North Korea link adds a geopolitical layer. If the attribution to TraderTraitor holds, the roughly $3 billion frozen by partners is a key battleground.

The things to watch next are fairly clear. First, whether the replenishment figure moves from about 95% to full coverage. Second, whether net flows stay positive as all 15-plus networks return to normal operation. Third, whether Binance publishes follow-up proof-of-reserves snapshots to confirm the October 31 picture holds.

Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.