Binance Lost Billions in Outflows After a $6.3 Billion Hack. Rivals Gained, but It Is Still Four Times the Next Exchange.
Tuesday, November 3, 2026. Bloomberg reported Monday that customers pulled a net $4.7 billion from Binance in the days after hackers drained about $6.3 billion in assets from the world's largest crypto exchange. DefiLlama-based outlets put the outflow above $7 billion. By Tuesday, Cointelegraph reported about $2.3 billion in net inflows over 24 hours and said Binance had replaced about 95 percent of the affected assets.
TRM Labs and Chainalysis attribute the hack to North Korea. The market-share question is more complicated than the outflow numbers suggest, and Washington's response so far is a stalled bill and an offer.
- $6.3Bassets affectedBinance's figure; TRM Labs puts it at about $6.36 billion across 10 blockchains in roughly 20 minutes on Oct. 29.
- ~$2.67Bfrozen stablecoinsPer BleepingComputer; early reports counted $1.79 billion from Tether and Circle alone. TRM estimates the attacker still holds about $2.4 billion.
- $4.7Bnet outflows from BinanceBloomberg's figure; DefiLlama-based reports exceed $7 billion.
- ~4xBinance vs. the next exchange by assetsAbout $127.9 billion at Binance against $29 billion at OKX, per DefiLlama as reported.
At about 20:05 UTC on October 29, roughly $6.36 billion left Binance wallets, mostly within 20 minutes, TRM Labs told BleepingComputer. Binance suspended deposits and withdrawals and said it would cover all losses from its SAFU reserve fund and company money. TRM and Chainalysis attributed the theft to TraderTraitor, a North Korean unit linked to the Lazarus Group, with “a high degree of confidence.” Binance itself has not attributed responsibility to any individual, CEO Richard Teng said, per BleepingComputer. No FBI or Justice Department attribution had been published in what we reviewed.
Binance links the theft to a compromised DevOps engineer's laptop that gave access to a service container, which let the attacker submit unauthorized withdrawals. Teng said the attacker “did not simply use one engineer's permissions,” and that it “was not a single 'one-click' action,” and the company found additional points of breach.
Withdrawals reopened on November 1. Bloomberg reported the $4.7 billion in net outflows; we could not read the article behind its paywall, and no post-hack market-share data from Kaiko or CCData was available. The evidence we can document is flows. OKX took in the largest single inflow, about $445 million on Monday per DefiLlama, with Bybit, Gate and Bitget also gaining, and Bitfinex reported roughly $280 million in 24-hour inflows, per Cointelegraph.
Scale cuts the other way. Even after losing billions, Binance held about $127.9 billion against OKX's $29 billion, DefiLlama data show. Before the hack its share of spot trading ranged from 28.5 percent in September, per CoinDesk, to 42.7 percent in the third quarter, per CoinGecko's top-10 sample; the two measure different samples. Bitcoin fell below $77,000, its weakest since August, and liquidations ran about $1.5 billion to $1.66 billion, mostly long positions, per CoinGlass.
The political argument is over what rules would have helped. Sen. Cynthia Lummis (R-WY) said the stalled CLARITY Act would have given faster freeze authority and liability protection. The bill passed the House in 2025 and failed a Senate cloture vote on September 15, 2026, short of 60. Better Markets' Amanda Fischer disputes the link, per Bitcoin.com News, saying voluntary freezes were already possible, and the stablecoin freezes here were voluntary.
CFTC Chair Michael Selig said on CNBC that the agency wants to “offer these exchanges a federal option to come and register with the CFTC,” a voluntary route with comments closing December 14; the CFTC cannot mandate registration without Congress.
Founder Changpeng Zhao pleaded guilty to a Bank Secrecy Act violation and received a presidential pardon in October 2025, per the Senate Banking minority release. We found nothing linking him to the October 29 hack. Sen. Elizabeth Warren (D-MA) and Sen. Chris Van Hollen (D-MD) pressed Justice and Treasury on the pardon, and nine Senate Democrats asked Treasury and DOJ in February 2026 to probe Binance's illicit-finance controls, per CoinDesk. We found no post-hack letter from them, and no reporting that regulators acted on the February request.
Documented: a roughly $6.3 billion theft on Oct. 29; billions frozen; net outflows and a partial rebound; withdrawals reopened Nov. 1.
Attributed, not charged: North Korea's TraderTraitor, by two private analytics firms.
Unknown: the real post-hack market-share figures, whether users are fully restored, and any government attribution.
Customers moved billions, and Binance still dwarfs every rival. The gap that remains open is regulatory: the main market-structure bill is stalled and the only new federal offer is voluntary.
