On October 29, 2026, Binance, the world's largest cryptocurrency exchange by trading volume, faced a large-scale cyberattack. Hackers withdrew assets worth approximately $6.3 billion, after which the company suspended withdrawals and began checking its infrastructure.
By November 2, Binance reported replenishing approximately 95% of the affected assets and published a new cryptographic proof of reserves, Proof of Reserves. Users were given the opportunity to independently verify the backing of their balances across ten cryptocurrencies.
However, alongside the resumption of operations, withdrawals from Binance began. According to Reuters, by November 2, the net outflow had reached $4.72 billion, or about 3% of the platform's asset value.
These events highlight two sides of the crisis. On one hand, the company was able to mobilize significant resources to compensate for the losses. On the other hand, financial recovery does not yet guarantee the return of customer trust.
To assess the real resilience of Binance, it is necessary to understand the circumstances of the attack, the structure of the reserves, the dynamics of client flows, and the consequences of the hack for the exchange's trading activities.
How the $6.3 Billion Binance Hack Happened
According to Binance's official statement on October 30, around 20:05 UTC on October 29, the infrastructure of the company's hot wallets was compromised. As a result of unauthorized operations, the exchange lost digital assets worth approximately $6.3 billion.
Hot wallets are used for daily deposits, withdrawals, and other operations requiring quick access to cryptocurrency. Unlike cold storage, where keys are isolated from constantly connected systems, such wallets interact with the exchange's operational infrastructure.
This allows for quick customer service but simultaneously creates additional risks. If attackers gain the ability to manage the transfer authorization system, significant volumes of assets are at risk.
An independent investigation by Bitquery established that from 20:04 to 23:56 UTC on October 29, funds were withdrawn from 17 Binance hot wallets across nine blockchains. Researchers found about 50 operation permissions signed by the exchange's infrastructure, which allowed the attackers to conduct transfers.
Meanwhile, the analytical company Elliptic used a broader scope and traced the movement of stolen funds across 11 blockchains. The difference is due to the methodology of tracking operations, so these estimates should not be considered mutually exclusive.
What is Known About the Causes of the Attack
The initial investigation by Binance pointed to a possible compromise of an employee's laptop. However, the company later reported discovering additional points of penetration.
Thus, the version of a hacked device cannot be considered the final explanation of the incident. As of November 3, Binance continued its technical investigation and had not presented a comprehensive public reconstruction of the attack.
On October 31, the U.S. FBI attributed the theft to North Korea-linked hackers, whose activities the agency designates as TraderTraitor. According to U.S. law enforcement, the stolen assets were primarily converted into Ethereum for further movement through cryptocurrency services.
After the incident was discovered, Binance revoked the compromised permissions, enhanced security checks, and suspended withdrawals. Deposits and services not affected by the restrictions continued to operate.
How Binance Covers Losses After the Hack
On October 30, Binance reported that it had reserved more than $6.34 billion to cover the consequences of the attack. Of this amount, about $5 billion was already allocated to the same cryptocurrencies that were affected by the hack.
At that time, the company estimated the degree of asset replenishment at approximately 80%.
In the following days, the exchange continued to acquire the missing tokens on the open market and through over-the-counter deals. By October 31, the declared figure had reached 90%, and by November 1, it had increased to about 95%.
In the update from November 2, Binance confirmed that the remaining 5% is predominantly in less liquid cryptocurrencies not included in the list of the ten largest affected assets.
Purchasing such tokens in large volumes may take more time due to limited supply. If the exchange tries to acquire the necessary amount of coins too quickly, it risks significantly impacting their market price.
Where Binance Sources Recovery Funds
According to the official Recovery Update No. 3 from October 31, the company used three sources of funding to replenish assets:
Binance's corporate treasury. The company's own funds, which are directed towards acquiring necessary crypto assets and covering losses.
SAFU Fund. The Secure Asset Fund for Users is intended to protect users during emergencies, including major security breaches.
Futures insurance fund. Binance used part of this fund's resources while retaining the remainder necessary to meet applicable regulatory requirements.
The company stated:
The financial consequences of this theft will be borne by Binance, not our users.
This commitment is crucial for users. If the company compensates for the damage from its own resources, client balances can remain secured even without the actual return of the stolen coins.
However, it is important to distinguish between three processes: reserving funds for compensation, replenishing missing crypto assets, and returning stolen property.
For example, freezing stolen stablecoins at the addresses of the perpetrators does not mean that these funds have already returned to Binance's control.
How Many Assets Still Need to Be Replenished
If we hypothetically calculate 5% of the initial damage estimate of $6.3 billion, it amounts to about $315 million. However, this figure is not a confirmed value of the remaining purchases.
The value of cryptocurrencies changes, and the need for replenishment is determined not only by the dollar equivalent but also by the quantity of specific tokens.
Moreover, Binance has not disclosed the full structure of recovery expenses. Therefore, it is not yet possible to determine how significantly the use of corporate resources has impacted the company's own capital.
According to the exchange, the recovery of affected assets is nearing completion. However, to assess the financial consequences of the hack, it is necessary to know how Binance's own assets have changed, how many resources remain available after compensations, and what additional expenses will be required to enhance security.
What the New Binance Proof of Reserves Confirms
On November 2, Binance published the fifth update on recovery after the hack. The main event was the completion of generating cryptographic proof for the reserve snapshot as of October 31, 2026, 00:00 UTC.
The verification covers ten crypto assets: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC. According to Binance, user balances for each of the listed assets are backed by reserves at a minimum ratio of 1:1. This means that within the published snapshot, the exchange confirms the presence of a sufficient amount of corresponding assets to cover the accounted client obligations.
Users can independently verify the inclusion of their balances in the Proof of Reserves data through the official Binance service.
How Proof of Reserves Works
The Binance Proof of Reserves system uses a Merkle Tree and zk-SNARK technology, allowing cryptographic verification of certain reserve information without disclosing clients' confidential data.
The Merkle Tree consolidates information about user balances into a verifiable structure. This allows account holders to confirm that information about their assets is included in the overall snapshot.
The zk-SNARK technology enables mathematical proof of meeting certain conditions, including the necessary coverage of accounted obligations, without revealing individual balances of other clients.
This mechanism enhances the transparency of exchange reserves, as part of the information becomes available for independent cryptographic verification.
However, Proof of Reserves is not a full financial audit.
It does not necessarily disclose the full extent of corporate obligations, the structure of creditor debt, potential encumbrances on individual assets, and the financial position of all legal entities within the Binance group.
Furthermore, the confirmation pertains to a specific point in time. The snapshot from October 31 does not prove that an identical volume of assets will be available in a few days.
This is why it is necessary to distinguish between three financial concepts:
Reserves indicate the availability of assets considered in securing certain obligations.
Liquidity reflects the exchange's ability to timely fulfill withdrawal requests and other short-term obligations.
Solvency characterizes the company's ability to cover total obligations considering the value and structure of its assets.
The solvency of a crypto exchange depends not only on confirmed user reserves but also on the full extent of its obligations, the quality of assets, and the ability to meet financial requirements.
Therefore, the publication of ZK-proof is an important step in restoring Binance's transparency, but it does not in itself guarantee the financial stability of the entire company.
The next reserve snapshot is scheduled for November 4. Binance plans to include additional tokens, after which it will take approximately 40–50 hours to form a new complete ZK-proof.
Why Clients Are Withdrawing Billions from Binance
Restoring reserves does not automatically mean the return of user trust. After a large-scale hack, some clients are eager to reduce dependence on a single trading platform, even if the company promises to fully cover the losses.
According to Reuters data from November 2, after resuming operations, Binance's net outflow reached $4.72 billion.
The company estimated it at approximately 3% of the platform's asset value. Meanwhile, Binance reported client inflows of $2.7 billion since the reopening of withdrawals.
Importantly, the net outflow represents the difference between outgoing and incoming capital flows. It is not equal to the total volume of withdrawals, so the stated $2.7 billion cannot automatically be added to $4.72 billion without verifying the period and calculation methodology.
Additionally, inflows do not necessarily mean that previously withdrawn assets have returned to the accounts of the same users.
Despite the significant volume of fund movements, the available statistics do not yet confirm a mass exodus of clients from Binance.
This has not yet caused mass panic or large-scale concentrated withdrawals.
This assessment aligns with the relative scale of the outflow. However, to draw a final conclusion about stabilization, it is necessary to observe client flows over a longer period.
How the Current Outflow Compares to Past Crises
To assess the scale of what is happening, it is useful to refer to previous episodes of cryptocurrency market instability.
In December 2022, after the collapse of FTX, Binance faced a net outflow of about $6 billion within 72 hours. At that time, users were massively reassessing the risks of storing assets on centralized trading platforms.
Another example is related to USDC. After the bankruptcy of Silicon Valley Bank in March 2023, the volume of stablecoin redemptions over a week amounted to about $7 billion, according to historical comparisons by Reuters.
These events differed in their causes and the structure of capital movements. In the case of Binance, it involves withdrawals from a cryptocurrency exchange, whereas with USDC, it was about stablecoin redemptions and changes in demand for it.
Nevertheless, both examples show that multi-billion dollar fund movements can occur during trust crises without necessarily leading to the immediate insolvency of the respective organization.
To assess how dangerous the current outflow from Binance is, several indicators need to be considered simultaneously:
Net client flows. Prolonged excess of withdrawals over deposits may indicate a sustained decline in confidence.
Change in reserves. It is important to analyze both the dollar value and the quantity of individual cryptocurrencies, as market revaluation can distort dynamics.
Withdrawal availability. Prolonged restrictions after infrastructure recovery require separate explanation.
Trading volumes. A decrease in activity relative to competitors may indicate a shift of operations to other platforms.
Market maker behavior. A decline in their activity can reduce market depth and increase trading costs.
Binance told Reuters that after the initial surge, withdrawal volumes began to stabilize. However, confirming the sustainability of this trend will only be possible through further observation.
Could Binance Face a Liquidity Crisis
Assessing Binance's liquidity after the hack is more complex than simply comparing the size of stolen assets with published reserves.
The exchange may have significant financial resources but temporarily face difficulties in processing certain operations. For example, necessary tokens may be in cold storage, have limited market liquidity, or use blockchain networks whose security is still being verified.
After a cyberattack, such restrictions become particularly important. A temporary halt in withdrawals may be a necessary protective measure, but to the user, it may outwardly resemble an issue with asset availability.
Therefore, it is necessary to distinguish between two situations. In the first, the company has sufficient funds but restricts operations to check infrastructure. In the second, it genuinely lacks available liquid assets to meet obligations.
As of November 3, public data does not confirm the presence of the second scenario for Binance. However, it also does not allow for an independent verification of the company's full solvency.
Which Operations Were Restored on November 3
In the official Recovery Update No. 6, Binance announced the expansion of the list of available assets and blockchain networks for withdrawal from 04:00 UTC on November 3. The second phase includes additional operations in the BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron, and Base networks.
The recovery is being conducted in stages after security checks are completed. Therefore, the availability of a specific token needs to be clarified immediately before the operation.
The same asset may be available for withdrawal in one network but remain temporarily unavailable in another. Binance also warned of possible delays in processing requests due to increased load. The resumption of operations reduces operational constraints for users but does not in itself prove that all consequences of the hack have been eliminated.
To assess Binance's real liquidity, it is necessary to monitor the stability of withdrawals under high load, the dynamics of assets in wallets, and the exchange's ability to service trading activity without significant deterioration in conditions.
Does Binance Maintain Leadership in the Cryptocurrency Market
For Binance's cryptocurrency exchange business, the consequences of the hack are not limited to the value of lost assets. The company depends on user trading activity, so a long-term reduction in turnover could affect its commission income.
According to Binance's own data, cited by Reuters, the platform serves over 335 million users worldwide, and its average daily trading turnover in spot and futures markets is about $95 billion. These figures demonstrate the scale of the business but do not confirm that the company's market share remained unchanged after the hack. The key factor is how clients manage their funds after withdrawing from the exchange.
If users transfer cryptocurrency to self-custody but continue to trade on Binance, the impact on turnover may be limited. However, if they shift activity to Coinbase, OKX, Bybit, and other platforms, the exchange may gradually lose part of its commission income.
After the resumption of withdrawals from Binance, other centralized exchanges also recorded an inflow of funds. During one of the considered 24-hour periods, OKX received about $284.87 million, Gate — $93.22 million, and Bybit — $29.25 million.
However, it is impossible to determine what share of these inflows is directly related to transfers from Binance clients based on available statistics.
Why Market Depth Matters
To assess Binance's trading resilience, it is necessary to consider not only the volume of transactions but also the available liquidity in order books. Market depth shows the volume of assets participants are willing to buy or sell near the current price.
If major market makers reduce activity, the spread between the best bid and ask prices may widen. Simultaneously, the execution of significant orders begins to have a greater impact on the price.
This situation increases traders' costs and may encourage professional participants to move operations to other platforms. Changes in the depth of BTC/USDT and ETH/USDT trading pairs are particularly indicative, as they belong to the most liquid segments of the cryptocurrency market.
For a comprehensive assessment, it is necessary to compare Binance's indicators with those of competitors for the same periods before and after October 29, taking into account the overall market change in trading activity.
As of November 3, the available confirmed data does not allow us to assert that Binance has already lost a significant market share. However, the dynamics of liquidity and trading volumes will become one of the main indicators of the long-term consequences of the hack.
How the Binance Hack Affected BNB and the Cryptocurrency Market
The consequences of the attack manifested not only in the movement of client funds but also in the quotes of digital assets. On October 30, Bitcoin fell to a six-week low of around $77,646, Ethereum reached a two-month low of $2,238.76, and BNB lost more than 8% in 24 hours, dropping to approximately $694.
According to The Block, during one observation period after the hack, BNB decreased by approximately 7.1%, Bitcoin by 4.5%, and Ethereum by 5.2%. These figures relate to specific observation moments, so they cannot be mechanically compared with price changes over full trading days.
Nevertheless, they show that BNB experienced more pronounced pressure than Bitcoin during the observed intervals.
At the same time, it cannot be asserted that all price changes were caused solely by the Binance hack. The cryptocurrency market was simultaneously influenced by overall investor sentiment, liquidity dynamics, and other macroeconomic factors.
Why BNB Reacts to Binance's Problems
BNB is used in the Binance and BNB Chain ecosystem, including the payment of certain fees and interaction with blockchain applications. However, BNB is not a share of Binance and does not grant holders corporate shareholder rights. Its market price does not represent a direct valuation of the exchange's business.
Nevertheless, a decline in trust in Binance may affect market participants' expectations regarding the activity of its ecosystem. If major clients reduce their use of the exchange's products, investors may reassess the demand prospects for related crypto assets.
For a more accurate assessment of the market reaction, several indicators should be analyzed: the dynamics of BNB relative to BTC and ETH, trading volumes, open interest in derivatives, funding rates, and position liquidations.
An increase in liquidations and sharp changes in open interest may indicate heightened tension among market participants but should be considered alongside price dynamics and overall trading conditions.
As of early November, the cryptocurrency market has partially recovered from the initial decline. According to Reuters on November 2, Bitcoin returned above $77,000, and Ethereum also regained some losses.
This indicates that the initial market reaction did not turn into a continuous large-scale sell-off of major cryptocurrencies.
How Safe is Binance After the Attack
Financial recovery does not negate the need to understand how attackers were able to withdraw funds of such a significant amount.
The Bitquery investigation showed that the attackers used permissions signed by Binance's infrastructure for operations. This makes the issue of the security of internal authorization and transfer control mechanisms particularly important.
According to preliminary Binance reports, no signs of wallet private key leaks were found. However, the investigation revealed additional points of penetration, so final conclusions about the attack mechanism are premature. The company reported the revocation of compromised permissions, strengthening security checks, and updating protective mechanisms. But the effectiveness of these measures can only be confirmed after the publication of a detailed technical report and analysis of the results of their implementation.
What Part of the Stolen Assets is Frozen
Stablecoin issuers and other participants in the cryptocurrency infrastructure played a significant role in limiting the consequences of the attack.
According to Elliptic's assessment, the total amount of stolen funds was about $6.43 billion, of which approximately $2.85 billion were frozen or seized. The discrepancy with Binance's initial estimate of $6.3 billion is explained by differences in methodology and asset valuation. According to Reuters on November 2, about half of the stolen funds were in stablecoins. Circle reported freezing more than $1.1 billion in USDC related to the attack.
This was made possible by the features of centrally issued stablecoins, whose issuers can block tokens at specific addresses under certain conditions. However, freezing is not equivalent to asset recovery. Additional legal and technical procedures may be required for their actual recovery.
With Bitcoin and Ethereum, the situation is more complex, as their underlying networks do not provide a similar mechanism for centralized blocking of transfers.
According to Elliptic's assessment provided by Reuters, as of November 2, the attackers still controlled assets worth about $3.28 billion, mainly in BTC and ETH.
This means that the investigation and recovery of stolen funds may take significantly longer than the immediate financial recovery of Binance.
Thus, the company is addressing two different tasks: replenishing user assets and trying to prevent a similar incident from recurring. Success in the first task does not guarantee a definitive solution to the second.
What risks remain for Binance
A large-scale hack can create consequences that extend far beyond the initial financial damage.
For Binance, three key areas of risk remain:
Reputational consequences. Even after full asset recovery, some users and institutional clients may reduce their capital concentration on a single exchange.
Operational expenses. Enhancing security, upgrading infrastructure, conducting investigations, and additional checks require resources that can increase business costs.
Competitive pressure. If clients transfer not only assets but also trading activities to other platforms, Binance risks facing a gradual reduction in market share.
A separate factor remains potential regulatory consequences. In different jurisdictions, cryptocurrency companies are subject to various requirements for client asset storage, operational resilience, and information disclosure.
However, the scale of the hack itself does not imply the inevitability of new fines or restrictions. Such conclusions require specific regulatory decisions and the results of relevant audits.
The most significant event will be the publication of Binance's full technical investigation. It should help determine whether the incident was due to a local vulnerability or broader deficiencies in the internal control system.
Three scenarios for Binance after the hack
As of November 3, the available data does not allow us to consider the Binance crisis resolved. However, they also do not confirm that the exchange is on the verge of insolvency.
The further development of the situation will depend on the dynamics of client funds, the recovery of operations, and the company's ability to maintain competitive positions.
Scenario 1. Restoring trust
Binance completes the replenishment of all affected assets, restores withdrawals for major cryptocurrencies, and continues to regularly publish verifiable data on reserves.
The initial surge in client withdrawals gradually shifts to stabilization, and trading volumes remain comparable to pre-crisis levels, considering the overall market dynamics. An additional positive factor is the publication of a technical report that explains the causes of the attack and confirms the elimination of identified vulnerabilities.
In this scenario, most of the compensation expenses may be one-time, although costs for security and reputation recovery will persist.
Scenario 2. Financial recovery without full trust restoration
In the second scenario, Binance fulfills its obligations to users, but some clients continue to reduce their balances on the platform.
Large traders and institutional participants distribute capital among several exchanges, reducing dependence on a single counterparty. This does not necessarily lead to solvency issues but may gradually decrease trading volumes, commission revenues, and Binance's market share.
The main sign of such a scenario will be the prolonged lag in the company's trading activity dynamics compared to competitors.
Scenario 3. Deepening crisis
The negative scenario assumes the continuation of significant withdrawal restrictions, the discovery of new vulnerabilities, or the emergence of additional financial obligations.
In such conditions, client outflows may accelerate, and market makers may reduce the available liquidity volume. This could increase trading costs and intensify pressure on Binance's competitive positions.
If the volume of freely available reserves simultaneously decreases, the company will find it more challenging to meet obligations under high load. However, this option should be considered as a risk rather than an already formed trend.
How Binance users can assess the safety of their funds
The Binance crisis shows why the reliability of a centralized exchange cannot be assessed solely by its size, fame, or trading volumes.
Even large platforms depend on the quality of internal control, infrastructure security, and the ability to meet obligations in stressful conditions.
For independent monitoring of the situation, it is useful to track several indicators.
1. Proof of reserves. On the official Proof of Reserves page of Binance, you can check published reports and review instructions for verifying balances. It is important to pay attention to the snapshot date, the list of assets, and the coverage of obligations.
2. Dynamics of Exchange Reserves. DefiLlama and other on-chain analytics services allow monitoring the change in asset values on known addresses of centralized exchanges. However, such assessments depend on the completeness of wallet identification and may include internal transfers.
3. Net Capital Flows. On-chain analysis helps evaluate the movement of funds, but for accurate conclusions, it is necessary to use comparable time intervals and consider the methodology of each source.
4. Availability of Withdrawals. Users should check the current status of operations for a specific asset and blockchain network. An announcement about the restoration of service does not mean that any withdrawal is already available.
5. Trading Liquidity. The depth of order books, spreads, and trading volumes indicate the quality of trade execution. Comparing Binance with competitors is preferable over identical periods.
6. Investigation Results. A full technical report and information on vulnerability remediation will allow assessing how the operational risk of the exchange has changed.
It is necessary to separately consider the differences between centralized and self-custody of cryptocurrencies.
When storing on an exchange, the user depends on its infrastructure, internal rules, and financial stability. When self-custody, control over private keys remains with the owner, but with it comes the responsibility for their safekeeping and access recovery.
Neither approach eliminates all risks. Therefore, security assessment should consider both the technological features of storage and the reliability of specific services.
Will Binance withstand the crisis of trust
The $6.3 billion hack was a serious test for Binance, but the initial recovery results indicate the company's ability to mobilize significant financial resources.
By November 2, the exchange announced the replenishment of about 95% of the affected assets and provided users with the opportunity to verify balance coverage for ten cryptocurrencies using new ZK-proof.
The net outflow of funds amounting to $4.72 billion also requires evaluation in the context of business scale. According to Binance, as reported by Reuters, it accounted for about 3% of the platform's assets. This figure alone does not prove a liquidity shortage.
However, financial recovery should not be equated with the complete overcoming of the crisis.
The publication of Proof of Reserves does not replace a full financial audit, and the restoration of withdrawals does not mean the automatic elimination of all technological risks.
For assessing Binance's future position, three key events are important: a new snapshot of reserves on November 4, the completion of operations recovery, and the publication of detailed results of the technical investigation.
The dynamics of client flows and trading activity in the coming weeks will remain equally significant.
If Binance maintains liquidity, completes asset compensation, and demonstrates the effectiveness of the updated security system, the financial consequences of the hack may be manageable.
However, if client outflows continue and begin to be accompanied by a reduction in trading volumes, the long-term damage to the business may exceed the initial recovery costs.
The main conclusion is that Binance is currently demonstrating the ability to cover the consequences of the hack, but full restoration of trust has not yet been confirmed. The further resilience of the exchange will depend not only on the size of reserves but also on the stability of operations, risk management quality, and the ability to maintain positions in the cryptocurrency market.