Skip to main content
eCrypto

Crypto markets, protocols and policy

Binance net outflows reach $5.28 billion after hack

Binance recorded $5.28 billion in net outflows over 46 hours after its $6.4 billion hack, as hourly deposits began to top withdrawals by Nov. 3.

eCrypto Editorial3 min read

Binance net outflows reach $5.28 billion after hack

Binance recorded $5.28 billion more in withdrawals than deposits in the 46 hours after a major hack, a sharp movement of funds as the exchange reopened withdrawals. The total included $10.97 billion in withdrawals and $5.69 billion in deposits, according to CoinDesk’s report on data shared by Binance chief executive Richard Teng.

The $5.28 billion net outflow is separate from the roughly $6.4 billion in crypto assets stolen during the Oct. 29 attack. CoinDesk cautioned that the withdrawals cannot all be attributed to customers reacting to the hack.

How did the hack affect Binance withdrawals?

Binance suspended withdrawals while it investigated and worked to contain the attack. It began restoring withdrawals in stages on Nov. 1, according to CoinDesk.

Withdrawal demand peaked that day. At one point, $936 million more left Binance than entered in a single hour, while withdrawals reached $1.24 billion in that hour.

The pace later eased. By 03:00 UTC on Nov. 3, hourly deposits were about $10 million higher than withdrawals, though the cumulative net outflow remained $5.28 billion.

Teng described the hourly shift as a sign of stabilising activity. The figures show the value moved through the exchange; they do not say how many customers withdrew or why each customer moved funds.

What happened in the Oct. 29 attack?

Binance said an attacker gained unauthorized access to an internal wallet-signing service and used it to initiate transactions outside the normal withdrawal process. Its initial incident report put the value of affected assets at about $6.34 billion.

The company’s account describes several stages:

  1. Five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address between 20:05 and 20:09 UTC.
  2. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP to attacker-controlled addresses.
  3. The attacker used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism, then moved 18,270 BTC from a Binance hot wallet.

Binance said the mechanism allowed an attacker-controlled smart contract to gain partial execution rights over a hot wallet. The company said the authorization operated on-chain, outside its normal withdrawal infrastructure, and required additional transactions to revoke.

What has Binance said about covering the loss?

Binance said it would absorb the financial impact through its Secure Asset Fund for Users and corporate treasury, rather than pass the stolen funds to customers. In its Oct. 30 update, the exchange said it had set aside more than $6.34 billion in company funds and that about $3 billion in affected assets had been frozen on-chain.

In its Nov. 3 report, Binance said 98% of the affected token assets had been replenished as of Oct. 31. It put the amount frozen or intercepted at about $2.85 billion, subject to reconciliation and market price changes.

The exchange said it had rebuilt or replaced systems in the attack path and was engaging independent security firms to review the incident. Its investigation was still ongoing in the report.

References