Binance tracked assets climb $3.4 billion in two days after post-hack withdrawal restart

The world’s largest crypto exchange, Binance, absorbed the loss of roughly $6.3 billion, the largest hack in history, using its own funds and a frozen $3 billion of stolen assets. Despite an initial outflow of $3.64 billion, the exchange’s balances rebounded, signaling a shift from a flight of capital to a recovery phase.

The attack occurred on October 29, 2026, at approximately 20:05 UTC, when attackers exploited weaknesses in Binance’s hot wallets and pulled tokens across multiple blockchains in about 20 minutes. The breach has been attributed to TraderTraitor, a group linked to North Korea.

Binance froze all withdrawals immediately after the attack and set aside more than $6.34 billion in corporate resources to cover the losses in full. Part of that money came from its SAFU reserve, an emergency fund built for exactly this situation, and part came from its futures insurance fund.

The recovery moved fast. By October 31, Binance had replenished approximately 90% of the affected assets, mostly through large token purchases on the open market and over-the-counter deals. That figure was later updated to about 95%.

Outside help mattered too. Partners froze roughly $3 billion of stolen assets tied to the hack, which limited how much the attackers could actually move or cash out. Binance also published a fresh proof-of-reserves snapshot taken at 00:00 UTC on October 31, confirming its major assets were fully backed.

Withdrawals resumed on November 1, 2026, rolled out in phases across more than 15 networks. Users did what users do after a hack. Initial net outflows came to around $3.64 billion.

That sounds like a lot, and it is. In context, it equals roughly 2.1% of Binance’s total assets under management, which stand at approximately $171 billion.

Then the number reversed. Binance’s tracked assets climbed by $3.4 billion over the two days following the withdrawal restart. Set side by side, the $3.4 billion gain lands close to the $3.64 billion in initial outflows.

The exchange did not quite return to where it started, but it got near enough to change the story from flight to recovery. One caveat is worth keeping in mind. A tracked asset figure does not separate fresh customer deposits from other movements on the balance sheet. Binance was actively buying tokens to replenish what was stolen, and that buying could account for part of the increase.

Exchange hacks are not new. What sets this one apart is scale. At roughly $6.3 billion, the breach marks the largest hack in crypto history. The response is also unusual. Many past exchange hacks ended with frozen accounts, socialized losses, or bankruptcy filings. Binance chose to absorb the entire hit with its own money and said customer assets remained intact.

That approach only works if an exchange has deep reserves on hand. Setting aside more than $6.34 billion on short notice is a capacity few platforms in the industry could match. For Binance, the two-day rebound is the most important data point since the attack. Covering losses is a balance sheet problem. Keeping customers is a trust problem.

The $3.4 billion increase suggests the exchange is making progress on the second, even if part of that number reflects its own replenishment buying. The initial $3.64 billion outflow still matters. Roughly 2.1% of assets heading for the door within the first phase of reopening is manageable for Binance.

The North Korea link adds a geopolitical layer. If the attribution to TraderTraitor holds, the roughly $3 billion frozen by partners is a key battleground. The things to watch next are fairly clear. First, whether the replenishment figure moves from about 95% to full coverage. Second, whether net flows stay positive as all 15-plus networks return to normal operation. Third, whether Binance publishes follow-up proof-of-reserves snapshots to confirm the October 31 picture holds.