Binance Sees Deposits Overtake Withdrawals as It Covers 95% of Stolen Assets

The update comes as the exchange expands withdrawal access across multiple blockchain networks and reports replenishing approximately 95% of the assets affected by the October 29 incident.

Binance announced on November 3 that deposits had started exceeding withdrawals on an hourly basis, pointing to improving activity following several days of heavy outflows. The exchange attributed the change to stabilizing transaction flows as users gradually resumed normal activity.

In its update, the exchange stated, “By 03:00 UTC, we are seeing hourly deposits exceed withdrawals, reflecting improving user activity and stabilizing flows.”

A 60-minute chart tracking Binance deposits, withdrawals, and net flows from November 1–3 shows that initial heavy outflows have gradually moderated. Source: Binance/X

The exchange also published a 60-minute interval chart covering deposits, withdrawals, and net flows between November 1 and November 3. The figures showed approximately $10.97 billion in withdrawals against $5.695 billion in deposits, resulting in a cumulative net outflow of around $5.276 billion during the 46-hour period.

Withdrawal activity was particularly intense shortly after the exchange began restoring services on November 1. The largest hourly outflow reached approximately $1.243 billion during the 08:00 UTC interval that day. Subsequent readings showed lower withdrawal volumes, while deposits gradually increased.

By the final hourly interval in the chart, deposits had reached approximately $193 million, compared with $183 million in withdrawals, producing a net inflow of around $10 million.

Although the latest reading marked a positive change, the cumulative figures showed that more funds had left Binance than entered during the broader measurement period. The hourly reversal therefore represents an early indication of stabilizing activity rather than a complete recovery in customer flows.

Binance co-CEO Richard Teng also addressed the exchange’s financial position during Hong Kong Fintech Week on November 3. He said withdrawal activity had initially increased following the incident but had subsequently “pretty much normalised.”

Teng added that the exchange remained in a position to absorb the financial impact of the security breach. Reuters reported that Binance had recorded approximately $4.72 billion in net customer withdrawals by Monday, representing around 3% of its platform assets.

Alongside the improving deposit figures, Binance has continued restoring withdrawal services through a phased process designed to complete security checks before reopening individual assets and networks.

In its November 3 recovery update, the exchange announced another round of withdrawal restoration beginning at 04:00 UTC. The expansion covers dozens of cryptocurrencies across BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron, and Base.

Binance has expanded withdrawal access to dozens of additional assets across Ethereum and Solana, including major tokens and memecoins, following its initial rollout. Source: Binance/X

The restored asset list includes Shiba Inu (SHIB), Chainlink (LINK), Pendle (PENDLE), dogwifhat (WIF), and Bonk (BONK), among other tokens. Additional assets include Bitcoin (BTC), Ethereum (ETH), Cardano (ADA), Litecoin (LTC), Polkadot (DOT), and several stablecoins.

The latest phase follows the initial reopening on November 1, when Binance restored selected withdrawals for assets including BTC, ETH, USDT, USDC, BNB, SOL, XRP, and ZEC across supported networks.

However, the exchange clarified that the newly listed assets would not all become available simultaneously. Each network and asset combination must pass the required security and operational readiness checks before withdrawals resume.

Binance said it was prioritizing assets based on user demand over the preceding week. Deposits have remained operational throughout the withdrawal restrictions, allowing customers to continue transferring supported assets into their accounts.

The exchange also introduced an additional wallet security measure. On November 1, the exchange updated its Proof of Reserves address list with newly generated wallet addresses and confirmed that future withdrawals would be processed through these addresses.

The withdrawal restoration follows Binance’s efforts to replace the approximately $6.3 billion in token assets stolen during the October 29 security breach.

Binance confirmed in its November 1 recovery update that it had replenished approximately 95% of the impacted amount, increasing from the previously reported 90%. The exchange attributed the recovery to its own financial resources, including the Secure Asset Fund for Users (SAFU) and corporate treasury funds.

The remaining 5% consists of less-liquid tokens outside the ten largest affected asset categories. Binance said these assets require additional time to acquire in sufficient quantities and that it continues working with industry partners and over-the-counter (OTC) providers to complete the purchases.

The exchange has also increased its Proof of Reserves disclosures to provide users with additional verification of their account backing.

On November 2, Binance announced that it had completed the zero-knowledge (ZK) proof for its October 31 Proof of Reserves snapshot. Users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC can independently verify that their balances are backed by reserves at a minimum 1:1 ratio.

The verification process allows users to check the backing of their balances without requiring Binance to disclose sensitive information about individual accounts. The exchange also planned another reserve snapshot for November 4, covering additional tokens, with the subsequent ZK proof expected to take approximately 40 to 50 hours to generate.

The exchange has maintained that customers will not bear the financial impact of the stolen funds. The company has also committed to publishing a detailed post-incident report after its investigation is complete.

The October 29 security incident remains the central issue behind Binance’s recovery efforts. The exchange initially reported that compromised hot wallets resulted in approximately $6.3 billion in unauthorized withdrawals.

The FBI attributed the October 29 Binance theft to North Korean state-backed hackers operating under the TraderTraitor campaign, identifying it as the largest known crypto heist. Source: FBI via X

Binance’s preliminary investigation pointed to a possible compromise involving a DevOps engineer’s laptop, which may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. The exchange later identified additional points of compromise but said it had found no evidence that wallet private keys were leaked.

On October 31, the Federal Bureau of Investigation (FBI) attributed the theft to North Korea, identifying the activity as part of the TraderTraitor hacking operation.

The agency reported that the attackers had primarily converted the stolen assets into Ethereum (ETH), potentially preparing them for further laundering through decentralized finance (DeFi) platforms and instant swap services. The FBI also urged cryptocurrency exchanges, blockchain infrastructure providers, and other industry participants to block transactions connected to the identified addresses.

North Korea rejected the US attribution, describing the allegations as unacceptable rhetoric, Reuters reported.

Meanwhile, Binance has continued cooperating with law enforcement agencies and blockchain intelligence firms to trace the stolen funds and support recovery efforts.

The latest deposit figures and expanded withdrawal access indicate progress in restoring the exchange’s operations. However, the cumulative net outflow, outstanding asset replenishment, and ongoing security investigation show that Binance’s recovery process remains incomplete.