Deposit flows steady as services resume
Binance customers pulled $3.64 billion, or 2.1% of its assets, as the exchange resumed service following a security breach linked to North Korea that saw $6.3 billion stolen from the platform, on Monday, Nov 2.
The exchange said customer withdrawals were stabilising following an initial surge and that deposit volumes remained substantial. Binance, which counts 335 million registered users globally, reported on Sunday that it held $171 billion in total assets under management as of October 28.
The net outflow figures reflected the combined impact of client withdrawals and deposits following the incident, Binance said. Crypto analytics platform DefiLlama published dashboard figures showing outflows reached $5.81 billion, revised upward from an earlier $4.36 billion, though a Binance spokesperson stated the platform metric did not account for funds deposited into the exchange's new hot wallet.
Tokens replaced as digital assets steady
The exchange said it covered 95% of the stolen assets, spending its own funds to purchase $6 billion worth of replacement cryptocurrencies, on Sunday. Binance stated that the remaining 5% of stolen tokens involved less liquid assets that could require additional time to source across secondary markets.
Withdrawals returned through a phased schedule prioritising 15 tokens based on recent trading demand, including bitcoin, ether, dogecoin, and portions of USDC and USDT, Binance announced on X. Bitcoin rebounded over the weekend from a six-week low recorded on Friday to trade above $78,000 on Monday, while ether recovered slightly to $2,287 after touching a two-month low on Friday.
For market participants, the swift recovery of trading infrastructure and collateral reserves is critical because prolonged disruption at the dominant centralised venue risks triggering liquidity contagion and shaking institutional confidence across broader digital asset markets.
Institutional outflows hit funds and stablecoins
Broader market gauges registered sharp contractions immediately after the breach. US spot bitcoin exchange-traded funds recorded $643 million in outflows on Friday, marking the largest single-day withdrawal of October, while more than $1.3 billion in leveraged trading positions were liquidated, according to Ari Redbord, global head of policy at TRM Labs.
Capital also exited dollar-pegged tokens, with the combined market capitalisation of the two largest stablecoins, USDT and USDC, dropping by about $1.2 billion since Friday, Coinmarketcap.com reported. The heist followed a broader pattern documented by TRM Labs, which calculated that attackers stole $2.9 billion across nearly 150 cryptocurrency incidents last year.
Individual institutions began reviewing risk exposure following the disruption. Jay Koh, vice president at the Asia Web3 AI Association, said that while he kept his holdings on the exchange because cold wallets avoided the intrusion, market participants should diversify custody arrangements and avoid concentrating excess capital on any single trading venue.
Investigators track rapid Thursday exploit
The Federal Bureau of Investigation said on Saturday that TraderTraitor, a North Korean state-sponsored cyber unit, carried out the theft. Law enforcement personnel observed unit members converting proceeds into ether, and the bureau stated that it anticipated further laundering of the funds.
The bulk of the transfer occurred within roughly 20 minutes late on Thursday and displayed technical hallmarks of earlier breaches linked to Pyongyang, according to blockchain intelligence firms TRM Labs and Chainalysis. North Korea has consistently denied deploying state-sponsored units for cyber operations, financial crime, or foreign currency acquisition.
Political reactions diverged over the weekend regarding formal culpability. United States President Donald Trump said on Saturday that direct North Korean involvement remained unconfirmed, telling reporters in remarks published on X that the administration would open discussions with Pyongyang if investigators confirm its role.
Watch: today's Zevin Newsroom
More from today's Journal
- OpenAI Lands in Abu Dhabi's Oil Heartland as ADNOC and G42 Sign On
- Kioxia's Profit Guide Falls Short and the Memory Trade Blinks
- All of today's edition on The Zevin Intelligence Journal
Not investment advice. The content is for information only and is not investment advice or a recommendation to buy or sell securities. Every investment carries risk. Consult a licensed adviser before making any decision.
Analysis first published in The Zevin Intelligence Journal on 2 November 2026. Published on Aizevin Ecosystem by Rachel, CEO Office.