After Binance began reopening withdrawals on November 1, customers pulled a net $3.64 billion in the first reported period; the total later reached about $4.7 billion. Binance said it had replaced 95% of the stolen assets, while reporting that withdrawals were stabilising.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer

Create a landscape editorial hero image for this Studio Global article: How did the $6.3 billion Binance hack around October 29, which the FBI attributed to North Korea’s TraderTraitor group previously linked to. Article summary: The hack triggered a withdrawal shutdown followed by billions of dollars in customer outflows when Binance reopened, while the exchange said it was replacing stolen assets and withdrawals were stabilising.[3][9][11] The . Topic tags: general, news, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers,
A $6.3 billion theft from Binance led the exchange to suspend withdrawals, then reopen them in phases. As customers regained access, they moved billions of dollars off the platform: reported net outflows reached $3.64 billion in the first measured period and about $4.7 billion by Monday morning. The figures show a sharp withdrawal response, but they do not by themselves establish a market-wide sell-off or prove that Binance was insolvent.3
11
17
The theft occurred on October 29, 2026. Binance suspended withdrawals while it responded to the security incident, then began restoring them on November 1. The first phase included Bitcoin, Ether and some stablecoin withdrawals; Reuters reported that it covered 15 crypto assets.8
11 The FBI later attributed the theft to North Korea’s TraderTraitor group, while blockchain analytics firm TRM Labs reported that about $6.36 billion moved across ten blockchains, mostly within roughly 20 minutes.
7
46
The staged reopening meant customers could not all withdraw at once during the initial suspension. Once services returned, Binance faced a large burst of withdrawals—an early, visible test of customer confidence after the breach.9
Between 06:00 and 15:30 GMT on November 1, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits. The reported net outflow was about $3.64 billion.3
11 Subtracting the rounded withdrawal and deposit totals gives $3.639 billion, which rounds to the reported figure.
By Monday morning in London, net withdrawals had risen to about $4.7 billion, according to Bloomberg.17 That later cumulative total does not contradict Binance’s statement that withdrawal activity was stabilising: the rate of withdrawals can slow even while the total continues to rise.
3
17
Reports also used different asset totals to put the outflows in context. Reuters described the initial $3.64 billion as 2.1% of Binance’s assets; a Binance post cited a $171 billion asset figure.3
19 Bloomberg reported about $4.7 billion in net withdrawals—less than 4% of a $128 billion asset figure.
17 These are different outflow amounts and asset benchmarks, so the percentages should not be treated as directly comparable. Neither ratio alone proves solvency or the absence of risk.
Binance said it was using company money to buy replacement tokens. Reuters reported the exchange’s coverage estimate rising from 90% to 95%; the remaining tokens were described as less liquid and potentially slower to source.2
3 Reuters also reported that Binance had covered about $6 billion of the $6.3 billion impact.
8
That is a company-reported replacement figure, not evidence that all stolen assets were recovered. Separately, Binance said withdrawals were stabilising after the initial surge.3 Together, these statements describe steps the exchange said it was taking to reassure customers; they do not erase the withdrawal shock or independently establish its financial condition.
Exchange outflows are not the same as sales. A customer withdrawing Bitcoin or Ether may move it to self-custody or another platform rather than sell it. The reported net outflows measure deposits and withdrawals from Binance, not how much customers sold across the wider market.
The available reporting does not isolate a price effect. The sources document the withdrawal surge, Binance’s response and calls from exchanges to strengthen security and share information. They do not quantify how the theft changed Bitcoin or Ether prices, or separate its influence from other market activity.3
4
17
A large theft can create competing market flows. If stolen assets are sold, that could add selling pressure; if Binance buys replacement tokens, those purchases could add demand. But without figures measuring the timing, size and market execution of those transactions, it is not possible to calculate a net effect from the supplied evidence.
The clearest supported conclusion is therefore about confidence and operations: the hack prompted a temporary withdrawal shutdown and billions in net customer outflows when withdrawals resumed. The numbers are significant, but they are not, on their own, proof of customer selling, a particular crypto-price move or an exchange solvency crisis.
Studio Global AI
This page includes a source-backed answer you can continue inside Studio Global.
After Binance began reopening withdrawals on November 1, customers pulled a net $3.64 billion in the first reported period; the total later reached about $4.7 billion.
After Binance began reopening withdrawals on November 1, customers pulled a net $3.64 billion in the first reported period; the total later reached about $4.7 billion. Binance said it had replaced 95% of the stolen assets, while reporting that withdrawals were stabilising.
The FBI attributed the theft to North Korea’s TraderTraitor group. The supplied reporting does not quantify the hack’s net effect on Bitcoin or Ether prices.
After Binance began reopening withdrawals on November 1, customers pulled a net $3.64 billion in the first reported period; the total later reached about $4.7 billion. Binance said it had replaced 95% of the stolen assets, while reporting that withdrawals were stabilising.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer

Create a landscape editorial hero image for this Studio Global article: How did the $6.3 billion Binance hack around October 29, which the FBI attributed to North Korea’s TraderTraitor group previously linked to. Article summary: The hack triggered a withdrawal shutdown followed by billions of dollars in customer outflows when Binance reopened, while the exchange said it was replacing stolen assets and withdrawals were stabilising.[3][9][11] The . Topic tags: general, news, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers,
A $6.3 billion theft from Binance led the exchange to suspend withdrawals, then reopen them in phases. As customers regained access, they moved billions of dollars off the platform: reported net outflows reached $3.64 billion in the first measured period and about $4.7 billion by Monday morning. The figures show a sharp withdrawal response, but they do not by themselves establish a market-wide sell-off or prove that Binance was insolvent.3
11
17
The theft occurred on October 29, 2026. Binance suspended withdrawals while it responded to the security incident, then began restoring them on November 1. The first phase included Bitcoin, Ether and some stablecoin withdrawals; Reuters reported that it covered 15 crypto assets.8
11 The FBI later attributed the theft to North Korea’s TraderTraitor group, while blockchain analytics firm TRM Labs reported that about $6.36 billion moved across ten blockchains, mostly within roughly 20 minutes.
7
46
The staged reopening meant customers could not all withdraw at once during the initial suspension. Once services returned, Binance faced a large burst of withdrawals—an early, visible test of customer confidence after the breach.9
Between 06:00 and 15:30 GMT on November 1, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits. The reported net outflow was about $3.64 billion.3
11 Subtracting the rounded withdrawal and deposit totals gives $3.639 billion, which rounds to the reported figure.
By Monday morning in London, net withdrawals had risen to about $4.7 billion, according to Bloomberg.17 That later cumulative total does not contradict Binance’s statement that withdrawal activity was stabilising: the rate of withdrawals can slow even while the total continues to rise.
3
17
Reports also used different asset totals to put the outflows in context. Reuters described the initial $3.64 billion as 2.1% of Binance’s assets; a Binance post cited a $171 billion asset figure.3
19 Bloomberg reported about $4.7 billion in net withdrawals—less than 4% of a $128 billion asset figure.
17 These are different outflow amounts and asset benchmarks, so the percentages should not be treated as directly comparable. Neither ratio alone proves solvency or the absence of risk.
Binance said it was using company money to buy replacement tokens. Reuters reported the exchange’s coverage estimate rising from 90% to 95%; the remaining tokens were described as less liquid and potentially slower to source.2
3 Reuters also reported that Binance had covered about $6 billion of the $6.3 billion impact.
8
That is a company-reported replacement figure, not evidence that all stolen assets were recovered. Separately, Binance said withdrawals were stabilising after the initial surge.3 Together, these statements describe steps the exchange said it was taking to reassure customers; they do not erase the withdrawal shock or independently establish its financial condition.
Exchange outflows are not the same as sales. A customer withdrawing Bitcoin or Ether may move it to self-custody or another platform rather than sell it. The reported net outflows measure deposits and withdrawals from Binance, not how much customers sold across the wider market.
The available reporting does not isolate a price effect. The sources document the withdrawal surge, Binance’s response and calls from exchanges to strengthen security and share information. They do not quantify how the theft changed Bitcoin or Ether prices, or separate its influence from other market activity.3
4
17
A large theft can create competing market flows. If stolen assets are sold, that could add selling pressure; if Binance buys replacement tokens, those purchases could add demand. But without figures measuring the timing, size and market execution of those transactions, it is not possible to calculate a net effect from the supplied evidence.
The clearest supported conclusion is therefore about confidence and operations: the hack prompted a temporary withdrawal shutdown and billions in net customer outflows when withdrawals resumed. The numbers are significant, but they are not, on their own, proof of customer selling, a particular crypto-price move or an exchange solvency crisis.
Studio Global AI
This page includes a source-backed answer you can continue inside Studio Global.
After Binance began reopening withdrawals on November 1, customers pulled a net $3.64 billion in the first reported period; the total later reached about $4.7 billion.
After Binance began reopening withdrawals on November 1, customers pulled a net $3.64 billion in the first reported period; the total later reached about $4.7 billion. Binance said it had replaced 95% of the stolen assets, while reporting that withdrawals were stabilising.
The FBI attributed the theft to North Korea’s TraderTraitor group. The supplied reporting does not quantify the hack’s net effect on Bitcoin or Ether prices.