Binance has entered a critical stabilization phase following the historic $6.3 billion security breach, with the exchange reporting that deposits are now exceeding withdrawals as user confidence gradually returns.
In an update posted on X, Binance stated that inflows have begun to outpace outflows, marking a significant shift from the initial panic that saw billions withdrawn within hours of the platform’s reopening.
User activity development shows that the exchange’s rapid remediation measures, full‑coverage pledge, and phased restoration of services are beginning to restore trust after one of the largest digital‑asset thefts ever recorded.
Anchoring After Days of Volatility
The days immediately following the attack were marked by intense volatility in user behavior. When Binance resumed withdrawals on November 1, customers withdrew $4.65 billion, while deposits totaled $1.01 billion, resulting in net outflows of $3.64 billion, or roughly 2.1% of Binance’s total assets.
The surge reflected understandable user anxiety after the Federal Bureau of Investigation (FBI) confirmed that North Korea’s TraderTraitor unit was responsible for the breach.
The attack drained an estimated $6.3 billion in tokenized assets from Binance’s hot wallets, prompting the exchange to suspend all deposits and withdrawals as it initiated emergency containment procedures.
However, within 48 hours of reopening withdrawals, Binance reported that flows had begun to stabilize. Deposits remained “substantial,” and withdrawal volumes declined sharply.
By the time Binance posted its latest update on X, deposits had overtaken withdrawals; a key indicator that user confidence was recovering
How Come Deposits are Now Exceeding Withdrawals?
1. Binance’s pledge to cover all losses
Binance reiterated that it would absorb the full financial impact of the stolen funds, not users. The exchange set aside more than $6.34 billion in company funds to replace stolen tokens, including $5 billion in the exact impacted tokenized assets.
The assurance played a central role in calming markets and reassuring users that their balances would remain intact.
2. Rapid freezing of stolen assets
Stablecoin issuers Tether and Circle froze more than $2.4 billion in USDT and USDC linked to compromised addresses within hours of the attack. Binance and blockchain‑analysis partners froze an additional $3 billion on‑chain, significantly reducing the attacker’s ability to liquidate stolen funds and demonstrated strong industry coordination.
3. Phased restoration of withdrawals
Binance resumed withdrawals in carefully controlled phases, prioritizing networks and tokens based on user demand. The first phase covered 15 major networks (including BTC, ETH, BNB, TRX, SOL, XRP, DOGE, and others) allowing users to access their funds while security checks continued.
The structured approach helped prevent system overload and reassured users that the platform was functioning safely.
4. Clear and frequent communication
Binance provided continuous updates through its official channels, outlining investigation progress, security enhancements, and recovery milestones. Transparency helped mitigate misinformation and stabilize sentiment.
Panic to Cautious Optimism: Range of Market Reaction
The initial breach triggered sharp declines across major cryptocurrencies. Bitcoin fell nearly 5%, while BNB dropped almost 10% as markets digested the scale of the attack.
But as Binance began covering losses and freezing assets, markets stabilized. Analysts noted that the exchange’s ability to absorb losses without passing them to users was a critical factor in preventing broader contagion.
Come November 2, user behavior had shifted. While withdrawals continued, they no longer outpaced deposits.
Binance’s X update confirmed that inflows had overtaken outflows: a sign that users were returning funds to the platform rather than exiting entirely. The shift suggests that Binance’s remediation strategy is working, though analysts caution that full trust recovery will take time.
