SINGAPORE / PARIS / NEW YORK — November 3, 2026
Binance customers have withdrawn a net US$4.72 billion (about S$6 billion) from the world’s largest cryptocurrency exchange since withdrawals reopened following a security breach that affected approximately US$6.3 billion in cryptocurrency.
The withdrawal wave represents roughly 3% of Binance’s assets, suggesting that while the incident has triggered a major confidence test, it has not yet produced a mass exodus from the platform.
Binance has pledged to cover customer losses, saying it has secured about US$6 billion through corporate funds, its insurance fund and security reserves. The exchange also said approximately US$2.7 billion in customer funds flowed back into the platform after withdrawals resumed, while withdrawal volumes began to stabilize.
The numbers underline the unusual nature of the crisis.
The US$4.72 billion figure represents net customer withdrawals following the reopening of the exchange. The US$6.3 billion figure refers to the estimated value of cryptocurrency stolen or affected during the security incident.
Those are not the same measure.
And as Binance works to reassure customers, the crypto industry is confronting a much larger question:
Can a centralized cryptocurrency exchange maintain customer trust after billions of dollars are stolen from its infrastructure?
Binance faces a multibillion-dollar confidence test
Binance suspended withdrawals for more than two days following the October 29 incident before beginning to restore access on November 1.
Once withdrawals reopened, customers moved billions of dollars away from the platform.
According to Reuters, the net outflow reached US$4.72 billion, while Binance said the withdrawals amounted to around 3% of the assets it held. Most of the withdrawals were reportedly in Tether’s USDT stablecoin.
The scale is substantial, but it is not unprecedented in crypto markets.
Binance itself experienced approximately US$6 billion in net withdrawals over 72 hours in 2022 following the collapse of FTX.
Circle’s USDC stablecoin experienced approximately US$7 billion in withdrawals over a week after Silicon Valley Bank collapsed in 2023.
The latest Binance withdrawals therefore represent a major stress event, but not necessarily evidence that the exchange is facing an immediate liquidity collapse.
Binance says it will absorb the losses
The exchange has repeatedly told customers that their balances will be protected.
Binance said it had raised approximately US$6 billion from its corporate treasury, insurance resources and reserves to address the stolen assets.
The company has also pledged that the financial impact will be absorbed by Binance rather than its users.
Reuters reported that Binance had replaced about US$6 billion of the US$6.3 billion in stolen assets using company funds, with the remaining losses involving less-liquid assets that could take longer to source.
That distinction is important.
Replacing customer balances does not necessarily mean every stolen cryptocurrency has been recovered.
The exchange can compensate customers while blockchain investigators continue trying to trace and freeze the stolen assets.
The security incident began with Binance’s internal systems
Binance’s preliminary investigation indicated that an attacker may have compromised a DevOps engineer’s laptop.
The suspected intrusion may have provided access to an internal service container that could submit unauthorized withdrawal transactions.
Binance said it found no evidence that wallet private keys themselves had been leaked.
That suggests the incident was not necessarily a simple case of an attacker obtaining a master key and emptying wallets.
Instead, it highlights a broader cybersecurity problem: cryptocurrency exchanges depend on layers of software, employee devices, authorization systems and operational infrastructure surrounding their wallets.
A weakness in those layers can potentially become just as consequential as a direct compromise of cryptographic keys.
WWC One Media examined this earlier in “Binance Faces $6.3-Billion Security Crisis as Tether and Circle Freeze $2.38 Billion”, which looked at the initial security incident and the emergency effort to restrict suspicious assets.
The latest developments show that the crisis has moved beyond the initial breach.
The new challenge is restoring confidence while determining how much of the stolen cryptocurrency can actually be recovered.
Investigators say billions remain difficult to recover
Blockchain investigators have continued tracking the stolen assets across multiple networks.
According to Reuters, blockchain intelligence firm Elliptic estimated that hackers still controlled approximately US$3.28 billion, primarily in Bitcoin and Ether, while the laundering process appeared highly complex and automated.
Stablecoins present a different situation.
Issuers such as Circle and Tether have mechanisms that allow them to freeze certain tokens associated with suspicious addresses.
More than US$1.1 billion in USDC had reportedly been frozen by Circle, while other industry partners were also working to restrict assets linked to the attack.
But frozen funds are not necessarily the same as recovered funds.
A frozen token cannot necessarily be spent, but it may still require additional legal and technical steps before ownership or control is resolved.
Bitcoin presents a harder recovery problem
The recovery challenge becomes even more complicated when stolen funds are held in Bitcoin.
Unlike centrally issued stablecoins, Bitcoin does not have a company that can simply freeze a particular wallet address.
Blockchain transactions remain visible, allowing investigators to follow the movement of coins, but tracing a transaction does not automatically give investigators control of the assets.
WWC One Media previously examined that issue in “$1.4 Billion in Bitcoin Stolen From Binance May Be Gone for Good, Expert Warns.”
That report examined blockchain analysis indicating that approximately 18,270 Bitcoin, valued at roughly US$1.4 billion at the time, had been transferred into multiple wallets.
The significance is not simply the amount.
It is the difference between being able to see stolen cryptocurrency and being able to recover it.
Investigators can monitor public blockchain transactions, but unless they gain control of the relevant assets or obtain them through legal enforcement, the coins can remain outside the exchange’s possession.
FBI attributes the attack to North Korea-linked TraderTraitor
The US Federal Bureau of Investigation attributed the Binance attack to TraderTraitor, a North Korean state-sponsored group.
The FBI said the group was responsible for the theft.
Blockchain intelligence firms including TRM Labs and Chainalysis have also pointed toward North Korean-linked activity.
However, North Korea has denied responsibility, describing the US allegations as unfounded.
That means the attribution should still be presented as a US government finding rather than an uncontested fact.
The investigation remains significant because North Korean-linked groups have previously been associated with large cryptocurrency thefts.
TRM Labs estimated that North Korea-linked hackers had stolen approximately US$7.4 billion in cryptocurrency during 2026, according to Reuters.
If confirmed, the Binance incident would represent another dramatic escalation in the financial scale of such operations.
Why the Binance withdrawals have not become a full-blown panic
The US$4.72 billion withdrawal figure sounds enormous.
But analysts say the percentage of Binance’s overall assets matters.
The withdrawals represented approximately 3% of assets held on the platform, while the exchange also recorded US$2.7 billion in inflows after reopening.
That suggests many customers have chosen to remain.
Some traders have reportedly kept their Binance accounts, while others have historically preferred to store assets away from centralized exchanges following previous crypto failures.
The situation therefore appears to be one of significant caution rather than universal panic.
That could change if Binance experiences additional security problems, prolonged withdrawal restrictions or evidence that customer assets are not fully backed.
For now, however, the platform continues operating.
Other exchanges are receiving some of the displaced funds
Blockchain data showed notable inflows into other cryptocurrency exchanges after Binance reopened withdrawals.
Reuters reported inflows into platforms including OKX, Gate and Bybit, although the data could not establish exactly how much of that money came from former Binance customers.
That movement illustrates one possible consequence of a major exchange hack.
Customers do not necessarily leave cryptocurrency altogether.
Instead, they may move their holdings from one centralized platform to another, transfer assets into personal wallets or move some funds into traditional currencies.
In that sense, the Binance incident could become less a crisis for cryptocurrency itself and more a crisis of confidence in centralized custody.
Crypto markets absorbed the initial shock
The hack initially pushed cryptocurrency prices lower.
Bitcoin reached a six-week low after the incident before recovering to trade above US$77,000 on November 2, while Ether also rebounded from a two-month low.
That recovery suggests the incident has not, at least so far, triggered a broad collapse across cryptocurrency markets.
However, other indicators showed stress.
Spot Bitcoin exchange-traded funds recorded approximately US$643 million in outflows on October 30, while more than US$1.3 billion in leveraged crypto positions were liquidated, according to TRM Labs.
Those figures cannot all be attributed solely to Binance.
Crypto markets were already experiencing volatility.
But the timing demonstrates how a major exchange security incident can amplify market pressure.
Institutional investors are watching closely
The consequences may extend beyond retail cryptocurrency traders.
Institutional investors increasingly use centralized exchanges, custodians and other digital-asset infrastructure.
A major breach therefore raises questions about whether exchanges can provide the level of operational security expected by professional investors.
The central concern is not necessarily whether cryptocurrency technology itself is broken.
The Block reported that analysts viewed the incident primarily as a failure involving centralized exchange infrastructure rather than a failure of Bitcoin’s underlying network.
That distinction could become important for the industry’s future.
If investors conclude that the blockchain itself remains reliable while centralized intermediaries are the weak point, the incident could accelerate demand for stronger custody systems rather than reduce interest in digital assets altogether.
The industry is now asking whether security controls went far enough
The attack has also raised questions about transaction authorization.
Binance’s preliminary account points toward compromised internal infrastructure rather than a straightforward leak of private keys.
That means future security improvements may need to focus on the systems surrounding cryptographic signing.
These can include employee access, internal authorization procedures, monitoring and mechanisms designed to identify abnormal transactions before they become irreversible.
WWC One Media’s earlier report “Binance Faces a Billion-Dollar Crypto Security Crisis as Tether and Circle Freeze Billions” explored this broader question when the breach first emerged.
The latest withdrawal figures show why those questions matter.
A technical vulnerability can become a financial crisis when billions of dollars are held on one platform.
Proof of reserves will become an important test
Binance has also taken a new proof-of-reserves snapshot following the incident.
The company said the new information would allow customers to verify backing for listed assets. Reuters reported that Binance planned to demonstrate at least 1:1 backing for the affected customer assets once the updated information was available.
Proof of reserves can provide useful information about whether an exchange holds enough cryptocurrency to match customer balances.
But it is not necessarily the same as a full financial audit.
It may not independently establish every liability, corporate obligation or legal claim involving the company.
For customers, the most important test will therefore be whether Binance can demonstrate that assets remain accessible, withdrawals function normally and the company has sufficient resources to honor its promise to absorb the losses.
The attack could change how exchanges handle security incidents
The Binance breach also demonstrates the value — and limitations — of industry cooperation.
Tether, Circle, blockchain intelligence firms, exchanges and law-enforcement agencies have all become involved in tracking or freezing assets.
That cooperation can potentially reduce the amount of cryptocurrency that attackers successfully move.
But it also raises difficult questions.
Who decides that an address should be frozen?
How quickly should companies act?
What happens if an address is incorrectly identified?
And how should decentralized networks interact with centralized companies that have the power to restrict certain assets?
The answers could shape cryptocurrency regulation and security practices for years.
What Filipino users should understand
The Binance incident does not establish that Philippine customers have lost their funds.
Binance says customer assets remain protected and that it will cover the financial impact of the attack.
However, the episode highlights why users should understand the difference between exchange custody and self-custody.
With exchange custody, customers rely on the platform’s security systems, financial reserves and ability to process withdrawals.
With self-custody, users control their own wallet credentials but also take on greater responsibility for protecting them.
Neither model eliminates risk.
The incident also creates an opportunity for scammers.
During major cryptocurrency security events, fraudulent accounts can impersonate exchange employees, investigators or recovery specialists.
Customers should be especially cautious about unsolicited requests for passwords, authentication codes or wallet recovery information.
The bigger question: Can Binance restore trust?
For now, the numbers suggest Binance has weathered the first stage of the crisis.
US$4.72 billion has left the exchange on a net basis.
But that represents about 3% of its assets.
US$2.7 billion has flowed back since withdrawals resumed.
Binance says it has resources to cover customer losses.
Bitcoin and Ether have recovered from their immediate declines.
And there is no clear evidence yet that the incident has destabilized traditional financial markets.
But trust is harder to measure than withdrawals.
Customers may leave gradually rather than all at once.
Institutional investors may demand stronger safeguards before increasing exposure.
Regulators may scrutinize centralized exchanges more closely.
And future security incidents could make the current outflow figures look small.
The Binance hack has therefore become a test not only of one company’s balance sheet but of the cryptocurrency industry’s broader promise that digital assets can be held securely at scale.
If Binance can survive a US$6.3-billion security breach and US$4.72 billion in net customer withdrawals, will the exchange emerge with stronger trust — or will this incident convince more investors that the biggest risk in crypto is not the blockchain itself, but who holds the keys?
