Binance Reopens Withdrawals: $2.5 Billion Flows Out, BNB Holds Up

Set Trending Topics as a preferred source on Google.

The floodgates are open again, and the feared bank run has so far been a trickle.

Just under three days after the largest crypto theft in history, Binance resumed withdrawals on Sunday morning. Shortly after 06:00 UTC, the first phase started with bitcoin, ether, BNB, Solana, XRP, Dogecoin, the stablecoins USDT and USDC and other assets on 15 blockchains, including Ethereum, BNB Smart Chain and Base. Binance ranked the networks by user demand over the past week, and the rest are to follow once they have passed their own security and stability checks. Deposits were never halted. At the same time, the exchange said on X that it had now replaced about 95 percent of the affected assets from its own funds, up from 80 and 90 percent in earlier updates. Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, it said.

How Binance Is Covering the Damage

In the attack last Thursday, the perpetrators drained cryptocurrencies worth about $6.3 billion (about €5.7 billion) from hot wallets, with a compromised employee laptop said to have been the point of entry. Binance says it has set aside about $6.34 billion in company funds and is buying the missing tokens on the market and over the counter. The money comes from three pots: the Secure Asset Fund for Users (SAFU), the emergency fund set up in 2018 that usually holds about $1 billion (about €900 million), part of the insurance fund for the futures business, and the corporate treasury. According to co-CEO Yi He, about half of SAFU will be used, and Binance plans to refill it to about $1 billion. This year’s revenue would fully cover the loss, He said, according to Bloomberg.

“Users will not bear the financial impact of this incident,” said co-CEO Richard Teng. The remaining 5 percent concerns smaller tokens outside the top ten, which are less liquid on the market and take longer to source at the required scale. Part of the damage could still come back: About $3 billion (about €2.7 billion) of the stolen assets had been frozen by Friday, mainly by Tether and Circle. Frozen does not mean recovered, however, as that usually requires court proceedings that can take months or years. According to the analytics firm Elliptic, the attackers still hold about $3.3 billion, including 18,270 bitcoin, and are moving the money on hourly via a Tron wallet, largely toward THORChain. The FBI blames the North Korean hacking group TraderTraitor for the attack and expects further laundering through DeFi protocols and instant swap services.

How BNB Is Holding Up

The exchange’s own token, BNB, has so far gotten off lightly. On the day of the hack it fell by a good 7 percent to about $699, and at one point the loss reached almost 10 percent. On Sunday, after withdrawals resumed, BNB traded at about $707 (about €636), roughly 6 percent below its level before the attack and below the 20- and 50-day averages, but well above the 200-day line at about $655. Analyst Rick Maeda of Laevitas called the decline “quite modest for possibly the largest exchange theft ever” and pointed to the roughly $144 billion Binance holds in custody for customers.

The comparison circulating in the industry since Thursday is FTX: Its token FTT crashed by more than 90 percent within days in November 2022 when it became clear that the exchange had gambled away customer funds. The Binance case is different: The assets were stolen, not embezzled, and the exchange has closed the gap from its own funds. The crypto market as a whole lost about 5 percent after the hack, compared with 25 percent after the FTX collapse. On Sunday, bitcoin was about 5 percent below its pre-attack high, and most major cryptocurrencies moved by less than 1 percent.

Is a Bank Run Looming?

The numbers from the first hours show how much trust was lost. According to DefiLlama, net outflows from Binance reached about $2.5 billion (about €2.25 billion) between the restart and Sunday evening. Over seven days, including the hack itself, net outflows add up to about $8 billion (about €7.2 billion). Competitors such as OKX and Bybit recorded slight inflows over the same period. Measured against the roughly $134 billion (about €120 billion) sitting on the platform according to DefiLlama, the outflows since the restart amount to just under 2 percent of assets. For comparison: No. 2 OKX holds about $29 billion.

There are several reasons it has not been more so far. First, Binance closed the gap before withdrawals resumed, so a bank run meets fully backed balances. Second, the exchange wants to follow up with a proof of reserves: The snapshot was taken at midnight UTC on October 31, and the full zero-knowledge proof is due by November 3. Third, the alternatives are limited, as no other exchange could absorb Binance’s volumes at short notice. “It hurts, but we survive,” wrote founder Changpeng Zhao.

What Remains Open

That is not reassuring yet. On Friday, Binance reported “additional points of breach” in its investigation without giving details, and Teng spoke of malware that erased its own traces. Exactly how the attack unfolded therefore remains unclear, and with it whether the gap has been fully closed. Withdrawals are also running for only some networks so far, and the real stress test comes when all assets can be withdrawn again. And the $2.5 billion from the first day is only the beginning: Large customers who move their balances to other exchanges or into self-custody as a precaution rarely do so within a few hours. Haseeb Qureshi of crypto investor Dragonfly nonetheless sees the industry’s quick response as a sign that it has matured. Whether the same applies to Binance’s customers will be shown by the outflows in the coming days.