Binance has recently faced a test of customer confidence after an October 29 security breach exposed about $6.34 billion in digital assets to theft. When the exchange restored withdrawals, customers moved billions off the platform. Net outflows reached $4.72 billion by November 2, Reuters reported , citing Binance.
The FBI attributed the theft to North Korea and named the activity TraderTraitor. Binance said it would absorb the financial loss rather than pass it on to customers. This breach also revealed a technical problem that a routine pause on withdrawals could not immediately solve.
A billion-dollar theft shook the world's biggest crypto exchange
Binance said attackers gained unauthorized access to an internal service used to approve transactions from its hot wallets. These wallets hold cryptocurrency ready for transfer. The intruders used the signing service to initiate transactions outside the exchange's normal withdrawal process.
The breach affected several networks. Binance reported that five hot wallets sent 233.46 million XRP to an attacker-controlled address within four minutes. Wallets on Solana and Optimism transferred about 970,500 SOL and 44.2 million OP. Another Binance wallet sent 18,270 bitcoin. The company estimated the total affected value at $6.34 billion.
The attackers also exploited Ethereum's EIP-7702 authorization feature. It allows an account to delegate certain actions to a smart contract without revealing its private key. Binance said the attacker used it to give a malicious contract partial control over a hot wallet. Because those permissions were recorded on the blockchain, suspending ordinary withdrawals did not automatically cancel them.
The FBI said the stolen cryptocurrency was being converted mainly into Ether, with further laundering expected through decentralized finance and instant-swap services. Binance said its containment work, including coordination with partners, led to about $2.85 billion in assets being frozen or intercepted. The figure remains subject to reconciliation and market-price changes.
Customers moved billions when Binance reopened withdrawals
Binance suspended withdrawals while responding to the breach, then began restoring access in phases on November 1. The initial reopening covered selected networks and assets. Customers regained access after a suspension lasting roughly 48 hours, although not every asset became available at once.
During the first nine and a half hours, Binance processed $4.659 billion in withdrawals and $1.01 billion in deposits. This produced a net outflow of about $3.64 billion. By November 2, the net figure had reached approximately $4.72 billion.
This $4.72 billion was not the total amount customers withdrew. Net outflows subtract deposits from withdrawals, showing the balance that left after incoming funds are counted. Binance said the figure represented about 3% of the assets on its platform. It also said withdrawals were stabilizing and deposits were increasing.
Binance promised to cover the stolen assets
Binance said customers would not have to absorb the loss. It said it had reserved more than the amount needed from its own resources and would replenish the affected assets. The company also reported that about $2.85 billion had been frozen or intercepted, although that is not the same as funds fully returned to the exchange.
In an update published November 3, Binance said it had replenished 98% of the affected token assets as of October 31. A November 4 update repeated this figure and said it was still buying the remaining tokens through market and over-the-counter channels. Binance warned that the final portion could take longer because these assets are less liquid.
This pledge addresses who bears the immediate loss, but it does not undo the security failure. The $4.72 billion in net withdrawals shows how quickly customers moved once access returned. Binance said it is commissioning an independent review. Its findings and security changes will matter to users deciding how much crypto to keep on the exchange.
Sources: Binance , FBI , The Block , Bloomberg , Livemint
Affiliate links on Cult of Mac may earn us and our partners a commission.
