Binance saw more than $5 billion in cryptocurrency outflows within 24 hours of reopening withdrawals after a record $6.3 billion security breach, according to on-chain analytics. Separately, blockchain investigators said North Korea-linked hackers moved about $242 million in stolen assets through the Tron network, underscoring the challenge for authorities as illicit funds travel across decentralized ecosystems.
Key takeaways
- Price move: The event drove large-scale token movements as Binance restored withdrawals and as stolen crypto shifted across networks.
- Catalyst: Binance’s withdrawal reopening on Nov. 1 followed the Oct. 29 incident that led to roughly $6.3 billion in stolen assets.
- Outflow scale: GreyBTC data cited outflows of more than $5 billion from Binance-associated wallets within 24 hours.
- Broader risk signal: Investigators reported around $242 million laundered via Tron, reflecting how quickly stolen funds can route through DeFi and bridges.
- Implication: Exchange security and customer trust remain central, while enforcement of restrictions appears harder when assets disperse across multiple chains.
What drove the outflows from Binance
Binance restored withdrawals on Nov. 1 after suspending them for about 45 hours following a security breach on Oct. 29. The breach resulted in approximately $6.3 billion in stolen assets, and the withdrawal pause appears to have prompted rapid customer and market repositioning once access returned.
According to GreyBTC, more than $5 billion moved out of Binance-associated wallets within 24 hours of withdrawals reopening. The report also noted that the figure represents roughly 3% of Binance’s reported assets of $171 billion prior to the attack.
However, analytics used to estimate flows can include internal transfer activity between exchange-controlled wallets. DefiLlama’s blockchain tracking data, for example, may capture movements that are not purely customer withdrawals, meaning the full $6 billion referenced in reporting should not automatically be interpreted as end-user withdrawals.
Withdrawal reopening and shifting liquidity across exchanges
Binance initially processed withdrawals progressively after access was restored, including major assets such as Bitcoin, Ethereum, Solana, XRP, and stablecoins. During the first nine and a half hours, Binance reported processing $4.649 billion in withdrawals against $1.01 billion in deposits, implying net outflows of approximately $3.64 billion for that early window.
At the same time, competing platforms saw inflows. DefiLlama data cited by the report showed OKX recording about $450 million in net inflows and Bybit receiving around $134 million. While those numbers suggest traders repositioned across venues after the disruption, the available data does not establish how much of the activity originated directly from Binance customer withdrawals.
Binance also stated that it replenished about 95% of the assets affected by the breach as of Nov. 1. The remaining portion was described as being concentrated in less liquid cryptocurrencies, potentially requiring additional time to replace.
Investigators: stolen funds move through Tron and beyond
While Binance addressed customer withdrawals, blockchain investigators identified continued movement of stolen assets across decentralized networks. According to reporting that referenced on-chain tracing by SomaXBT, North Korean attackers laundered approximately $242 million through the Tron network over two days.
The attackers reportedly stole about $628 million in Tron-based assets, but stablecoin issuer Tether froze roughly $378.7 million in USDT, limiting the amount available for further movement. Investigators estimated that about $194 million of the $242 million subsequently moved off Tron via bridges and swapping services, while the remainder was split between funds that stayed on-chain and transaction-related costs, including slippage and market fluctuations.
Several DeFi infrastructure providers handled portions of the activity. The report cited Relay with about $48 million, THORChain with approximately $44 million, Chainflip with about $32.1 million, and Symbiosis with about $16 million, totaling roughly $140 million across those protocols. It also cited additional processing through Bitget Wallet of about $41.7 million, though the ultimate destination was not specified.
Symbiosis acknowledged weaknesses in its screening mechanisms and said it was working to address them. The broader takeaway from investigator reporting is that DeFi networks face significant constraints in detecting and blocking sophisticated laundering routes, especially when illicit value moves across multiple blockchains and liquidity tools.
Authorities apply pressure, but billions remain difficult to freeze
The FBI attributed the Binance attack to North Korea’s TraderTraitor hacking group and, alongside other US authorities, urged THORChain operators, decentralized exchanges, and infrastructure providers to restrict transactions linked to the stolen assets. Investigators also identified hundreds of related cryptocurrency addresses.
Enforcement actions have already reached a portion of the stolen value. Elliptic reported that approximately $2.85 billion in stolen assets had been frozen or seized. Still, the reporting emphasized that billions remained outside the effective reach of traditional asset-freezing mechanisms, reflecting the limits of conventional containment approaches in a multi-chain environment.
For investors, the next focus is whether Binance’s withdrawal processes remain stable after the initial rush and whether additional law-enforcement or DeFi protocol updates further curb movement of remaining stolen assets. Market participants will also be watching upcoming developments from regulators and blockchain analytics providers as they track the flow of funds across bridges, swaps, and custody services.
