• Binance reports hourly deposits now exceed withdrawals after last week's $6.3 billion hack.
  • Cumulative net outflows since withdrawals resumed total $4.72 billion, with 95% of affected tokens replenished.
  • Customer retention efforts and regulatory scrutiny intensify as the exchange works to restore confidence.

Stabilization Signs Emerge

Binance, the world's largest cryptocurrency exchange, said Tuesday that hourly deposits have begun to outpace withdrawals, marking a potential turning point after a $6.3 billion theft last week triggered a rush to withdraw funds. The update, posted on the company's website, noted that withdrawals for additional assets had been restored and that 95% of affected tokens had been replenished. Co-CEO Richard Teng said outflows had "pretty much normalised" by November 3, though he acknowledged that the remaining tokens are less liquid and harder to source.

The positive hourly flows, however, do not erase the cumulative $4.72 billion net outflow reported through Monday, according to figures compiled by the exchange. That represents about 2.1% of the platform's $171 billion in assets as of October 28, based on company statements. While the marginal improvement is encouraging, it does not independently establish Binance's financial health, and the exchange has yet to provide a full accounting of the losses.

The Hack and Immediate Fallout

The trouble began on October 29 when Binance suffered a reported $6.3 billion theft, leading the exchange to suspend deposits and withdrawals while investigating. Teng later described a complex attack involving a compromised laptop and malware designed to erase evidence. The FBI has attributed the breach to North Korea's state-sponsored TraderTraitor group, an allegation Pyongyang rejected as "absurd rhetoric."

Withdrawals resumed in phases on November 1. Between 06:00 and 15:30 UTC that day, Binance reported $4.65 billion in withdrawals against $1.01 billion in deposits—a net outflow of $3.64 billion. The exodus continued into Monday, with cumulative net withdrawals reaching $4.72 billion. On Tuesday, the exchange said it would absorb the financial impact rather than pass it to customers, drawing on corporate treasury, the Secure Asset Fund for Users (SAFU), and part of the Futures Insurance Fund. Binance set aside approximately $6.34 billion to cover losses, though replaced tokens are not the same as recovered assets.

Efforts to Retain Customers

To stem the outflow, Binance has launched a retention campaign running through November 21, offering fee rebates, rewards for eligible users meeting trading-volume thresholds, and annual percentage rates of up to 10% on certain yield products. These incentives accompany—not independently validate—the reported improvement in flows. A spokesperson for the exchange said the measures are designed to reward loyal customers and ensure a smooth experience during the recovery period.

Still, questions remain about the exchange's transparency. The company has not released independently verified consolidated revenue or profit figures, and management's assertion of "very strong financial health" should be treated as a company statement rather than an audit conclusion. Binance and outside blockchain trackers have reported different outflow totals, with Binance arguing that some third-party estimates misclassified transfers to its own new wallets. Differences in timestamps and wallet classification mean those figures should not be combined as though they measure identical activity.

Leadership and Regulatory Context

Changpeng Zhao (CZ), Binance's founder and former CEO, resigned in November 2023 as part of a $4.3 billion settlement with U.S. authorities over anti-money-laundering and sanctions violations. Richard Teng succeeded him, and Yi He became co-CEO in December 2025. Both are now leading the response to the breach. CZ remains a significant shareholder but holds no operational role. His recent comment that "98% choose to stay" contrasts with the roughly 2% outflow figure, which measures asset value—not the percentage of customers who withdrew.

The incident has drawn fresh scrutiny to exchange cybersecurity and custody controls. The FBI's attribution to North Korea highlights the growing threat of state-sponsored crypto theft, with analysts suggesting additional sanctions targeting wallets and laundering networks could follow. North Korea's rejection of the accusation adds diplomatic friction, though the immediate market impact has been relatively contained. Crypto prices initially fell but stabilized, with investors seemingly distinguishing a security failure at a centralized exchange from a problem with the underlying blockchain technology, according to Maksym Repa, head of DeFi at Lombard.

What to Watch

The most informative indicators in the coming days will be sustained daily net flows, completion of withdrawal restoration, and progress in converting frozen assets into actual recoveries. Binance reported approximately $3 billion located or frozen in the early response, but frozen assets are not automatically recovered funds. The exchange has pledged to publish a full incident report, though it has not set a timeline. For now, the stabilization in hourly flows offers a glimmer of hope, but the cumulative outflow and lingering questions over reserves mean the recovery is far from complete.

Correction: An earlier version of this article misstated the date of the hack. It occurred on October 29, not November 3.