Binance sees $5 billion in outflows after record $6.3 billion breach

Binance has experienced more than $5 billion in cryptocurrency outflows following the reopening of withdrawals after a record-breaking $6.3 billion security breach. 

Meanwhile, blockchain investigators report that North Korean hackers have moved approximately $242 million in stolen assets through the Tron network, intensifying scrutiny of decentralized finance protocols.

The developments have raised concerns about exchange security, customer confidence, and the ability of authorities to prevent stolen cryptocurrency from moving across blockchains.

Binance records $5B outflows after withdrawal reopening

Binance witnessed substantial cryptocurrency movements after restoring withdrawals on November 1, following a security breach on October 29 that resulted in approximately $6.3 billion in stolen assets.

According to GreyBTC, more than $5 billion moved out of Binance-associated wallets within 24 hours of withdrawals reopening.

Grey BTC@greybtc

$14B has left Binance in just 7 days. After the $6.3B hack on Oct 29, withdrawals reopened Nov 1, and the money started moving. −$5.14B in the last 24h alone. Is trust in Binance broken, or is this just a temporary panic?

▶1 Replies17 LikesView on X

The figure represented approximately 3% of the $171 billion in assets reported by Binance before the attack.

However, DefiLlama's blockchain tracking data can include internal exchange wallet transfers, meaning the entire $6 billion should not be interpreted as customer withdrawals.

Binance initially suspended withdrawals for approximately 45 hours before gradually restoring access to major cryptocurrencies, including Bitcoin, Ethereum, Solana, XRP, and stablecoins.

During the first nine and a half hours, Binance reported processing $4.649 billion in withdrawals against $1.01 billion in deposits, producing net outflows of approximately $3.64 billion.

Despite the significant activity, Binance maintained that withdrawal demand had begun stabilizing.

The disruption coincided with increased cryptocurrency inflows at competing exchanges.

According to DefiLlama data, OKX recorded approximately $450 million in net inflows, while Bybit received around $134 million.

Although these movements suggest traders were repositioning assets across trading platforms, available data does not establish how much originated directly from Binance.

Binance also reported replenishing approximately 95% of the assets affected by the breach as of November 1.

The remaining portion primarily involved less liquid cryptocurrencies, which may require additional time to replace.

North Korean hackers allegedly launder $242 million

While Binance managed customer withdrawals, blockchain investigators identified substantial movements of stolen cryptocurrency across decentralized networks.

According to the on-chain investigator SomaXBT, North Korean attackers laundered approximately $242 million through Tron within two days.

SomaXBT@somaxbt

1/ Binance exploit just passed 2 days, and so far the attackers (laundering team) have laundered ~$242M through the Tron leg alone, out of the $3.5 billion they still controlled after the freezes. Here is the full analysis of the laundering from my tracing 🧵

14 Replies234 LikesView on X

The hackers reportedly stole around $628 million in Tron-based assets. However, stablecoin issuer Tether froze approximately $378.7 million in USDT, limiting the amount available for further movement.

Investigators estimated that approximately $194 million of the $242 million subsequently moved off Tron through bridges and swapping services.

Another $26 million remained on the network, while approximately $22 million was attributed to transaction costs, slippage, and market fluctuations.

Several decentralized cryptocurrency services reportedly processed transactions associated with the stolen assets.

Relay handled approximately $48 million, followed by THORChain with $44 million, Chainflip with $32.1 million, and Symbiosis with $16 million.

Together, these protocols accounted for roughly $140 million in movements. Investigators also identified $41.7 million processed through Bitget Wallet, although the final destination remained unclear.

Symbiosis acknowledged weaknesses in its screening mechanisms and said it was working to address them.

The findings highlight the difficulties decentralized protocols face when identifying and restricting sophisticated money-laundering activity across multiple blockchains.

FBI pressures crypto platforms to block stolen funds

The FBI attributed the Binance attack to North Korea's TraderTraitor hacking group, which has previously been associated with major cryptocurrency thefts.

Working alongside other US authorities, the agency urged THORChain operators, decentralized exchanges, and infrastructure providers to restrict transactions linked to the stolen assets.

Investigators identified hundreds of cryptocurrency addresses associated with the attack.

Meanwhile, blockchain analytics firm Elliptic reported that approximately $2.85 billion in stolen assets had been frozen or seized.

Despite these interventions, billions remained outside the reach of conventional asset-freezing mechanisms.