1. How much money has left Binance since the hack?
Binance customers withdrew $10.97 billion in the 46 hours that followed the $6.4 billion hack of the exchange, and withdrawals exceeded deposits by $5.28 billion over that stretch. The figures were shared on Tuesday, November 3, by Binance CEO Richard Teng, who published blockchain data on X to illustrate how funds have moved since the October 29 attack.
The numbers give an early picture of Binance outflows after the breach. They also come with a caution: the $6.4 billion that was stolen is a separate matter from the later withdrawals, so the two amounts should not be added together. Nor can every withdrawal be put down to customers reacting to the breach, since an exchange of Binance's size sees large movements of funds on any ordinary day.
The arithmetic is straightforward. Of the $10.97 billion that left the exchange, $5.69 billion came back in as deposits between November 1 and the early hours of November 3. Subtracting one from the other gives the net outflow of $5.28 billion.
2. When did withdrawal pressure peak?
Withdrawals were at their heaviest on November 1. In the worst single hour, $936 million more left Binance than entered it, and total withdrawals in that hour reached $1.24 billion. That hour marks the point of greatest strain in the data Teng presented.
After that peak, the pace of outflows eased over the following two days. Deposits between November 1 and the early morning of November 3 added up to $5.69 billion, which offset part of what had gone out.
The shape of the data, a sharp peak followed by a gradual slowdown, is a familiar pattern after a security incident at a large exchange. Customers who are most concerned move first, and the rate of departure then falls as the situation becomes clearer. The data does not show whether the slowdown will continue or whether new shocks could renew the pressure.
3. Are deposits now exceeding withdrawals?
Teng pointed to a change in direction in the most recent hours. By 03:00 UTC on November 3, hourly deposits were exceeding withdrawals by about $10 million. That is a small margin compared with the hourly flows seen at the peak, but it marks a reversal from the net outflows that dominated the previous two days.
Teng wrote on X that "the trend is starting to show more positive inflows with hourly deposits exceeding withdrawals." He presented the shift as evidence that the exchange is stabilizing after the incident.
The cumulative picture is less settled. Even with hourly flows turning positive, net outflows since the hack still stood at $5.28 billion at that point. One hour of net inflow does not offset that total, and a single reading cannot show whether the improvement is lasting.
4. Who is responsible for the attack?
The FBI attributed the October 29 attack to TraderTraitor, a hacking group linked to North Korea. The attribution places the Binance incident among the largest thefts in the history of the crypto industry, and it ties the loss to a state-linked actor rather than to an independent criminal group.
The attribution matters for the exchange's recovery in practical ways. State-linked groups are known for patient planning and for laundering stolen funds across many wallets, which makes recovery of the assets harder than it would be in a conventional theft. The data from Teng, though, concerns customer behavior and not the movement of the stolen funds.
It is also worth separating the two sets of numbers clearly. The $6.4 billion refers to the amount taken by the attackers. The $10.97 billion refers to money that customers withdrew from their accounts in the following hours, a measure of confidence in the exchange rather than a measure of the theft itself.
5. Why do outflow figures matter for an exchange?
An exchange holds customer assets on their behalf, and its standing depends on customers being able to take those assets out when they choose. Large withdrawals after a security breach test whether the exchange has enough liquid reserves to meet demand and whether customers continue to trust it.
Net outflows, the difference between money leaving and money arriving, are a particularly useful measure. Gross withdrawals can be large simply because of heavy trading, but a persistent gap between withdrawals and deposits indicates that customers are moving funds elsewhere in greater numbers than new funds are coming in.
In this case the net figure of $5.28 billion is smaller than the gross withdrawal figure of $10.97 billion because a large share of money flowed back in. That return flow, $5.69 billion over roughly two days, shows that many customers continued to use the platform even while others left.
For regulators, counterparties and users, the speed of the recovery in deposits is an early indicator of how well the exchange is coping, though it is no substitute for a fuller accounting of its financial position.
6. What are the limits of the data Teng shared?
The figures are drawn from blockchain data that the CEO himself chose to publish, and they cover a defined period of 46 hours. They do not describe flows that took place outside that window, and they do not break down which customers withdrew, how large their balances were or where the funds went.
Because the data comes from the exchange's own leadership, it reflects a particular framing of events. The reading that hourly deposits exceeding withdrawals signals stabilization is Teng's, and it rests on a single time period when the margin was about $10 million.
Independent analysts will want to test the claim against longer series of data. If deposits continue to exceed withdrawals over several days, the reading becomes stronger. If the gap closes again or flips, the early sign of recovery will look less convincing.
7. What comes next for Binance's recovery?
The key measurement to watch is whether hourly deposits keep outpacing withdrawals in the coming days. A sustained run would suggest that confidence is returning, while a renewed wave of net outflows would indicate that the early improvement was temporary.
The cumulative net outflow of $5.28 billion is the other benchmark. The pace at which that figure shrinks, if it does, will show how much of the money that left the platform in the first two days is returning.
Teng has not yet announced a timetable for further updates to these figures, and the data covers only the period through the early hours of November 3. More information from the exchange, and independent verification of it, will be needed before conclusions can be drawn about the long-term effect of the hack on its customer base.
8. How should readers interpret gross and net flows together?
Reading the two measures side by side gives a fuller view than either one alone. Gross withdrawals of $10.97 billion describe the volume of money that left customer accounts during the 46-hour window. Gross deposits of $5.69 billion over the part of that window beginning November 1 describe money that arrived. The net figure is simply the balance between them.
A large gross figure with a small net figure usually describes an active but resilient platform, where money moves in both directions. A large gross figure with an equally large net figure would describe a one-way exodus. The Binance numbers fall between these cases: the net outflow is substantial, yet roughly half of the withdrawn amount was matched by incoming deposits.
Timing is the other consideration. The deposit total quoted covers the period from November 1 to the early hours of November 3, while the withdrawal total covers 46 hours, so the windows are close but not necessarily identical. For that reason the net figure is best read as an approximation of the overall direction rather than as an exact audit.
None of this changes the central point of the data: customers took out far more than they put in during the first two days, and the balance shifted only in the most recent hours.
9. What does the hack mean for confidence in large exchanges?
A theft of $6.4 billion is large by any measure, and it falls on the world's biggest crypto exchange, which is why the follow-on behavior of customers is being watched so closely. How users respond to an incident of this scale tends to shape the wider perception of whether centralized platforms are safe places to hold assets.
The flows described by Teng show two sides of that response. A substantial group of customers chose to move funds off the platform, and another substantial group continued to deposit. The reversal in hourly flows on November 3 suggests that, at least for some users, the immediate concern has begun to fade.
Exchanges facing a similar situation usually communicate with the public through data of the kind Teng published, because visible flows are one of the few ways to demonstrate that withdrawals are being honored. Publishing numbers on a public social platform also invites outside scrutiny, which can add credibility if the data holds up and cost credibility if it does not.
The coming days will therefore matter as much as the first two. A steady pattern of deposits and withdrawals returning toward normal would support the CEO's reading, while renewed volatility would suggest that the exchange still has work to do in rebuilding trust.
Until more data is published, the figures should be treated as a snapshot of a developing situation, not as a final tally of the effect the attack has had on the exchange or its users.