Binance Deposits Overtake Withdrawals After $6.3B Hack as User Activity Stabilizes

Binance is seeing early signs of stabilising user activity after the $6.3 billion security breach on October 29. The exchange said hourly deposits had overtaken withdrawals by November 3, suggesting that the initial rush to move funds off the platform was beginning to ease.

The update came after Binance gradually reopened withdrawal services on November 1. The exchange had temporarily suspended withdrawals following the attack, which affected its hot-wallet infrastructure and led to one of the largest cryptocurrency thefts on record.

Binance's latest flow data showed $10.97 billion in withdrawals and $5.695 billion in deposits between November 1 and November 3. This left the platform with approximately $5.276 billion in cumulative net outflows since withdrawals resumed. However, the hourly balance turned positive by 03:00 UTC on November 3, when deposits began exceeding withdrawals. 

Binance Records $1.82 Billion in 24-Hour Net Inflows

Separate wallet-tracking data also showed a positive development.

Approximately $1.822 billion in net inflows across Binance-tracked wallets over a rolling 24-hour period. The tracked wallets held approximately $127.7 billion in assets at the time of the snapshot. 

This figure needs to be viewed separately from Binance's cumulative withdrawal data.

The $1.822 billion represents the net change in tracked wallet flows over a rolling 24-hour window. It does not mean that Binance received that amount in new customer deposits during a single day.

Similarly, the positive hourly deposit balance does not erase the withdrawals recorded since November 1. The exchange was still showing cumulative net outflows of more than $5 billion in its published flow data.

The two figures nevertheless suggest that the initial withdrawal rush was losing momentum and that some funds were beginning to return to Binance-linked wallets.

Most Withdrawals Went to Self-Custody Wallets

Another important detail concerns where users moved their assets after withdrawals reopened.

Binance founder Changpeng Zhao (CZ) said that only around 6% to 10% of withdrawals went to other centralized exchanges, citing publicly available reports. Most of the movement was reportedly toward self-custody wallets that had not yet interacted with decentralized exchanges. 

Self-custody allows users to control their own cryptocurrency through private keys rather than keeping assets on a centralized exchange.

This distinction matters when interpreting Binance's outflows. A withdrawal does not necessarily mean that a customer has abandoned the platform or sold their cryptocurrency. Some users may simply prefer to hold their assets in personal wallets while the exchange completes its security reviews.

However, movement into self-custody still represents a loss of exchange-held balances. It also highlights how a major security incident can change user behaviour even when the exchange continues operating.

Binance Says It Has Replenished 95% of the Stolen Assets

Binance has also made progress in covering the financial impact of the attack.

The exchange initially announced that it had set aside more than $6.34 billion in resources to cover the estimated $6.3 billion loss. These resources include its Secure Asset Fund for Users (SAFU), Futures insurance reserves and corporate treasury funds. 

By November 1, Binance said it had replenished approximately 95% of the affected assets. The remaining 5% consisted mainly of less liquid tokens that take longer to acquire in the required quantities.

The exchange said it would absorb the financial impact rather than pass the losses on to customers. It also confirmed that major assets, including BTC, ETH, USDT, BNB, SOL, USDC and XRP, were fully backed. 

Related: Binance Covers 95% of $6.3B Hack Losses as Withdrawals Resume

On November 3, Binance co-CEO Richard Teng said the company remained in strong financial health and that customer inflows and outflows had largely normalised. He also said the exchange planned to publish a detailed post-incident report. 

FBI Attributes the $6.3 Billion Attack to North Korea

The security incident has also drawn attention from U.S. law enforcement.

On October 31, the FBI formally attributed the theft to North Korea and identified the activity as part of the TraderTraitor hacking operation.

According to the FBI, the attackers stole more than $6 billion in virtual assets from Binance on or around October 29. Investigators also observed the stolen assets being converted primarily into Ether as the attackers attempted to move them through additional services. 

Blockchain intelligence firms had previously linked the attack to North Korean hacking operations. Their findings pointed to compromised internal systems and transaction-signing infrastructure rather than a confirmed leak of wallet private keys.

The investigation remains important because the breach affected more than one blockchain network. It also raises questions about the security of centralized exchange infrastructure and the systems used to authorize withdrawals.

Related: North Korea Stole $6.36B From Binance; About $2.7B Is Frozen

Are Binance Users Regaining Confidence?

The latest flow data offers an early indication that conditions are improving, but it is too soon to call the recovery complete.

Hourly deposits exceeding withdrawals suggest that the immediate rush to withdraw funds has eased. The relatively small share of reported outflows moving to rival centralized exchanges also suggests that many users chose self-custody rather than switching trading platforms.

However, cumulative net outflows remain substantial. The exchange must also finish restoring affected assets, complete its security investigation and provide further transparency through its proof-of-reserves reporting.

The next important signal will be whether positive hourly flows continue over several sessions. A sustained return of deposits, alongside the restoration of remaining withdrawal networks, would provide stronger evidence of improving confidence.

For now, Binance has made progress on two fronts: restoring customer access and replenishing affected assets. The latest inflow figures are encouraging, but the longer-term test will be whether users continue trusting the exchange after the largest security incident in its history.