Binance Reopens Withdrawals After Record $6.3 Billion Hack
Net outflows hit $3.64 billion on day one. The reaction is the read on whether confidence holds.
Photo by Adam Śmigielski on Unsplash
Binance reopened withdrawals after a record $6.3 billion hack. Net outflows hit $3.64 billion, or 2.1% of assets, in the first day.
Withdrawals are back, in phases
Binance began restoring withdrawals early Sunday, three days after attackers drained about $6.3 billion from its hot wallets. Bitcoin was the first network to reopen, followed by Ethereum and BNB Smart Chain. By 7:36 a.m. ET the exchange had turned on 15 digital currencies, including Solana, XRP and Dogecoin.
The rollout is deliberate. Each network goes live only after security checks clear, and Binance says more assets will open as those reviews finish. Co-CEO Richard Teng framed it as a careful approach and repeated the line that Binance, not its users, will absorb the loss.
That is the right order of operations for an exchange that needs to prove solvency in public. A full reopening on day one would have invited a run. A phased one lets the firm control the pace and watch balances in real time.
The first day of flows
Binance said it processed $4.65 billion in withdrawals and $1.01 billion in deposits across its first window on Sunday. Net outflows came to $3.64 billion. Against roughly $171 billion in total assets, that is 2.1%.
That number is smaller than a bank run and larger than a rounding error. Founder Changpeng Zhao posted that 98% of users chose to stay, and said most of the net outflow came in the first couple of hours. Binance also said withdrawal volumes declined and stabilized after the initial spike, while deposits stayed substantial.
The shape of the curve matters more than the headline total. A spike that fades within hours looks like users who wanted proof they could get out. A steady drip over several days would look like something else. Monday and Tuesday flows are the ones to track.
The coverage gap
Binance said Saturday that it had set aside more than $6.34 billion in company funds to cover the losses. Reported coverage of affected assets has been cited at both 90% and 95% depending on the update. The remaining gap sits in less liquid tokens that the exchange is still buying in the market.
That detail is worth watching. Buying thin tokens to make users whole can move those prices, and it ties the pace of full restoration to market depth rather than to Binance's balance sheet alone. Until the gap closes, some of the phased reopening is constrained by inventory, not security checks.
Attribution and market damage
The FBI said Saturday that North Korea was behind the attack, pointing to a Pyongyang affiliated group called TraderTraitor. Binance's own analysis said several features matched earlier North Korean heists, including the Bybit hack and the KelpDAO exploit in April 2026. Those features include small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. President Donald Trump has cast doubt on North Korea's involvement, so attribution is not a settled political question even if investigators treat it as one.
The theft dwarfs the roughly $1.5 billion Bybit hack in 2025. When the news broke, Bitcoin fell nearly 5% and Ethereum nearly 6%. BNB, the exchange's own token, dropped nearly 10%, which is the cleanest read on how much counterparty risk the market priced into Binance itself.
BNB sold harder than the majors because its holders carry the exchange's credit risk directly. A recovery in BNB relative to Bitcoin would signal that the market is accepting the solvency story. Continued underperformance would say it is not.
What to watch next
Three things decide whether this stays a one day liquidity test. First, daily net outflows after Sunday, which should keep shrinking if the 98% figure is real. Second, the remaining phases of the withdrawal rollout and whether any network stalls. Third, how fast Binance closes the 5% to 10% coverage gap.
For trading desks, BNB against Bitcoin is the ratio to follow. Exchange equities like Coinbase also trade as a read on sector confidence when a rival has a security event. Track the unusual activity in crypto linked names on the [Whale Alerts dashboard](/whalealerts) as the week opens.