Binance's tracked wallets registered approximately $3.25 billion in 24-hour net inflows, according to Defillama data, reversing the heavy withdrawals that followed the exchange's $6.3 billion hack on Oct. 29.
Following the breach, Binance recorded more than $7 billion in daily outflows. The exchange paused withdrawals for security checks, then reopened them in phases, expanding support to additional assets. By Nov. 3 at 03:00 UTC, hourly deposits exceeded withdrawals—the first measurable sign that immediate panic may be fading.
Despite the recent positive flow, longer-term data remains negative. Defillama shows approximately $12.16 billion in seven-day net outflows and $10.85 billion over 30 days. In the first 46 hours after withdrawals reopened, the exchange processed $10.97 billion in withdrawals against $5.70 billion in deposits, leaving a $5.28 billion deficit.
Binance co-founder Changpeng Zhao noted that only a small portion of withdrawals moved to rival centralized exchanges. Zhao said 6 to 10 percent of funds went to other CEX platforms, with the majority moving to self-custody wallets that have not yet interacted with decentralized exchanges. Co-CEO Richard Teng confirmed the exchange is seeing "more positive inflows" as the immediate crisis recedes.
Binance covered all customer losses using its own resources. The exchange's tracked on-chain assets currently stand at roughly $128.8 billion.
Co-founder Yi He linked the Oct. 29 incident to a broader pattern of state-sponsored attacks. Yi He noted that Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026. These tactics included fraudulent job interviews, malicious developer tools, compromised software packages, browser extensions, fake video-conferencing applications and social-engineering campaigns designed to steal credentials or deploy remote-access malware.
Yi He emphasized the challenge: "We intercepted many of them, but the cost of failing to stop even one was severe, and this should never have happened."
U.S. officials have attributed the Oct. 29 attack to a North Korean group. Pyongyang has denied the accusation, with Kim Yo Jong questioning the U.S. attribution and highlighting Washington's policy of confiscating stolen bitcoin.
