The Binance withdrawal run: three ledgers after a contested hack
The most revealing number in the Binance affair may not be the $6.3bn reported stolen. It may be the gap between the totals used to describe what customers did next. After the theft on or about 29 October 2026, Binance suspended withdrawals for 48 hours as a precaution, according to The Independent, then announced on Sunday that they had resumed. By then, the story had split into three ledgers: customer flows, company-funded replacement of stolen assets and onchain funds that may be frozen or still moving.
Each ledger answers a different question: access, loss-bearing and recoverability. The nearly $4bn headline crosses all three but belongs cleanly to none. The useful skill is not picking the biggest number but knowing what each figure measures.
A run measured in windows
The Independent reported Binance’s own account of activity between 06:00 and 15:30 UTC on 1 November: about $4.649bn in withdrawals, about $1.01bn in deposits and a net outflow of approximately $3.64bn. That is a snapshot of one nine-and-a-half-hour window after access returned, not a cumulative total for the whole episode.
Bloomberg reported a larger cumulative figure: $4.7bn in net withdrawals by Monday morning in London, according to a Binance spokesperson. Its fetched excerpt said this was about 3 per cent of total assets under management. Both figures came from the company side, and the asset base was not consistently reported.
The difference between $3.64bn and $4.7bn is therefore not necessarily a contradiction. One measures a short period, the other a cumulative flow, with deposits netted and timing that shifted as withdrawals returned. The nearly $4bn headline is a signpost to those figures, not an audited ledger.
What a withdrawal run can tell us
A centralised exchange is, for customers, a promise of access. They hold a balance on a platform and rely on its systems, controls and balance sheet to turn that balance into tokens or cash when they ask. A withdrawal freeze tests that promise directly. A run tests it under load.
The sequence was short and controlled. Binance stopped withdrawals for 48 hours, then restored them in phases, prioritising tokens by recent demand. The pause delayed customers’ ability to leave. Whether it limited the eventual outflow is not established, and neither possibility is captured by a simple percentage of assets.
Binance’s own framing is that the outflow was modest relative to the platform. The figure of about 3 per cent attributed to its spokesperson supports that argument at the level of liquidity pressure. It does not independently establish solvency, customer balances or the safety of every asset. Nor does a large gross withdrawal figure prove panic: deposits also continued during the window. Customers move funds for many reasons, and the reporting does not establish their motives.
Three ledgers, not one
The first ledger is the customer flow already described. The second is the company’s effort to replace what was stolen. On Saturday, according to ABC News, Binance said it had enough set aside in the same digital currency that was taken to cover 90 per cent of the missing assets, with the remaining 10 per cent in less liquid tokens. The company also said it would fully cover the financial impact.
That statement was not a stable recovery rate. The Defiant reported a 30 October update in which Binance estimated the loss at about $6.3bn and said roughly $3bn had been frozen onchain. It then reported a 2 November update in which Binance said it had covered about 95 per cent of the impacted amount, with the rest in less liquid tokens. The Independent separately reported Binance’s claim that 95 per cent of the stolen tokens had been recovered. Set aside, covered, replaced and recovered are not interchangeable descriptions.
The third ledger is onchain. Frozen funds are not returned funds, and company-funded replacement is not the same as clawing back an attacker’s assets. The Defiant reported that the FBI alert urged crypto businesses, decentralised finance services and infrastructure operators to block transactions involving the listed addresses or funds traced from them. It also reported that the alert did not announce a sanctions designation or authorise the return of frozen assets. Blocking a transaction can prevent further movement; it does not settle ownership or put money back in a customer’s account.
Without reconciled onchain accounting, the public cannot add the 90 and 95 per cent statements to the $3bn frozen figure to get a precise recovery total. The company’s claims may be accurate and still measure different things: set aside, replaced, covered and recovered. The distinction decides who is made whole, when and from whose resources.
The attribution and the denial
The FBI attributed the theft of more than $6bn in virtual assets from Binance on or about 29 October to North Korea and named the activity TraderTraitor, according to The Independent. Binance’s own estimate was about $6.3bn. ABC News reported that the bureau said stolen assets were being converted primarily into Ethereum and that it expected further laundering through decentralised finance and instant swap services.
Chainalysis said it had high confidence that a North Korean actor was linked to the hack, the BBC reported. The Defiant reported that Chainalysis cited Binance funds commingling with proceeds of September’s Bitget exploit, which it also attributed to North Korea. That is an analytical assessment, not a court finding.
North Korea rejected the attribution. The Defiant reported a KCNA statement dated 2 November in which Kim Yo Jong dismissed the US assertion as absurd and a political provocation. KBS carried the statement in Korean on a page dated 3 November local time and reported that she accused Washington of misleading international opinion by linking cyber fraud to North Korea.
A denial is a public claim, not evidence of innocence. Equally, the FBI’s attribution and Chainalysis’s confidence assessment are not a court verdict. The public case is stronger than a single headline because an official attribution and a separate analytics assessment point the same way. It remains an attribution, reported second-hand and untested in court. Readers can take it seriously without treating it as final.
The attack path is still a company account
Attribution and causation are separate questions. Even if the North Korean link is accepted, the technical account of how the theft happened remains unsettled. The BBC reported that Binance initially thought an engineer’s laptop had been compromised, then said the attack was wider. Co-CEO Richard Teng said the subsequent investigation uncovered additional points of breach and that the attackers used a mechanism that destroyed their tools and traces as they went, making tracing harder.
That is Binance’s account, not an independent forensic finding. The description has already changed once, from a suspected laptop compromise to a broader intrusion, and it may change again. The safer reading is to take the reported details as the company’s current explanation, not a settled reconstruction. The same caution applies to claims about exact amounts frozen, the speed of laundering or the attackers’ next move. These are reported assessments, not a live public ledger.
The promise and the contract
Binance’s promise to absorb the loss is important, but it is a company statement. The BBC reported that legal experts warned customers not to regard it as legally binding and that recovery could depend on their contracts. Lawyer Daniel Tunkel of Edwin Coe was reported as saying that the question would depend on what customers had been promised and whether Binance could be sued for non-performance.
That is a general legal view, not a ruling on any customer’s contract. It marks a boundary. A public promise can shape expectations without creating an immediate, enforceable claim for every user. Customer protection is also separate from technical recovery. A company can replace stolen tokens from its own resources while the attackers’ funds remain frozen or untraceable. A customer’s practical position depends on the asset, the network, the balance and the account terms.
What would change the picture
Several records would settle more than any new headline. A primary FBI advisory would clarify the attribution language, the listed addresses and the blocking request. Binance’s incident updates, reserve disclosures and proof-of-funds material would show what it set aside and replaced. An independent forensic account would test its explanation of the intrusion. Reconciled onchain accounting would separate frozen funds, recovered tokens, replacement assets and customer balances.
Consistent outflow data would also help. Current figures cover different windows, use different asset bases and rely heavily on Binance or its spokesperson. One methodology over time would show whether the run was a short spike, a sustained transfer of custody or something in between. Later reporting on the next withdrawal phase would show whether access continued to improve or stalled.
Until those records exist, the Binance episode is best understood as three linked tests. Can customers get their money back, and on what terms? Who ultimately bears the loss: the company, its insurers and reserves, or the customers? And how firm is the attribution that has turned a security incident into a geopolitical accusation? The withdrawal numbers are the most visible signal, but they do not answer those questions on their own.
Set aside, covered, replaced, recovered: four words that sound like one outcome until you ask who bears the loss and from whose resources it comes. Reading a security incident well means keeping that vocabulary precise, separating a company’s statement of intent from an independent finding, and knowing which figure answers which question. Cybersecurity fundamentals is where that discipline starts, covering how incidents, access and controls are described as distinct, checkable things rather than one reassuring total. If you would like to build that habit, explore The Hack Academy’s online cybersecurity training programme, which lists cybersecurity fundamentals among its subject areas and sets self-paced learning and practical exercises alongside the theory.