Cryptocurrency exchange Binance has officially restored withdrawal services for the hyperliquid (HYPE) and aptos (APT) networks, marking another incremental step forward in its ongoing operational recovery following the historic $6.3 billion security breach suffered in late October. As the platform works to bring remaining asset networks back online following rigorous security evaluations, independent blockchain intelligence data highlights significant fluctuations in exchange reserves. Metrics provided by analytics firm Cryptoquant point to substantial outflows of bitcoin, ethereum, and stablecoins in the immediate wake of the incident, even as daily withdrawal pressures appear to show signs of stabilization.
The progressive restoration of services represents the latest chapter in Binance’s response to the October 29 security incident, which compromised hot wallets spanning multiple blockchains and resulted in the theft of approximately $6.3 billion. Blockchain investigators and United States law enforcement authorities have attributed the sophisticated attack to North Korean state-sponsored threat actors, cementing the event as the largest cryptocurrency theft recorded in dollar terms in the history of the digital asset industry.
Binance announced the latest expansion of its operational capabilities through social media channels on Sunday, confirming that users can once again execute withdrawals across the HYPE and aptos networks. This development comes on the heels of an earlier commitment made by the exchange on November 6, wherein leadership pledged to re-enable withdrawal functionality for HYPE, APT, INJ, PLASMA, NEAR, and LTC by the conclusion of the following week. Notably, the HYPE and aptos networks have beaten that projected timeline, while other withdrawal channels continue to undergo individual, high-security reviews before being reopened to the public.
The phased reactivation strategy initially commenced on November 1, when Binance successfully restored withdrawal access for several primary cryptocurrencies distributed across 15 separate blockchain networks. In the days that followed, the exchange steadily broadened its support infrastructure to encompass dozens of additional digital assets, including various tokens built on the Ethereum and Solana ecosystems. Despite these operational milestones, detailed onchain examinations offer a broader look at the financial fallout experienced by the platform during the crisis.
According to data compiled from Cryptoquant through November 8, Binance’s overall bitcoin reserves experienced a notable contraction in the wake of the breach. Holdings fell from a pre-attack baseline of approximately 730,000 BTC down to 673,700 BTC. This reduction represents a decrease of roughly 56,000 BTC, or approximately 7.7% of the exchange’s total bitcoin holdings. Based on bitcoin’s market valuation of around $75,800 recorded over the weekend, this shift corresponds to roughly $4.2 billion in assets.
The most acute phase of these movements unfolded during a concentrated window between late October and early November. Daily netflow figures during this period recorded heavy negative volumes, including single-session outflows of approximately 14,500 BTC, 22,000 BTC, 16,500 BTC, and 9,000 BTC. In particular, the 22,000 BTC withdrawal metric stands out as the single largest daily net outflow recorded over a 12-month statistical window.
Nevertheless, subsequent blockchain tracking reveals that the intensity of these capital flights has diminished. Later sessions captured a positive netflow of 10,400 BTC, indicating that initial panic selling and immediate withdrawal momentum were beginning to dissipate. More recent readings point toward modest positive daily netflows of approximately 1,300 BTC, marking a stark contrast to the extraordinary capital movements observed immediately following the reopening of withdrawal routes.
While bitcoin figures display signs of stabilization, Ethereum’s reserve metrics illustrate a more severe proportional impact. Binance’s ethereum reserves declined from an estimated 3.48 million ETH prior to the attack down to 3.08 million ETH. This translates to a reduction of roughly 400,000 ETH, or 11.5% of the platform’s total ethereum holdings. The downward pressure was underscored by multiple severe daily netflow sessions, with individual readings nearing negative 175,000 ETH and 155,000 ETH. Although the pace has slowed considerably, recent daily ethereum netflows have remained in negative territory, hovering around 5,500 ETH.
Beyond native layer-one cryptocurrencies, Binance’s Ethereum-based stablecoin reserves encountered the steepest proportional contraction across the entire asset spectrum. Prior to the breach, stablecoin holdings stood at approximately $41 billion. By November 8, that figure had fallen to $32 billion, marking an absolute drop of roughly $9 billion, or 22%. This percentage decline significantly outpaces the proportional reductions observed for either bitcoin or ethereum.
During the peak of the post-hack activity, individual daily stablecoin net outflows reached staggering levels, with two separate sessions approaching $3.3 billion and $3.6 billion respectively. These figures were roughly triple the largest comparable daily withdrawal volumes recorded throughout the entirety of 2026 prior to the incident. Even so, the most recent daily metrics suggest that this extraordinary surge has largely abated, registering positive stablecoin netflows of approximately $27.9 million.
Market analysts note that these reserve adjustments should not be conflated with Binance’s previously disclosed figures regarding direct customer actions. The exchange had earlier reported approximately $3.64 billion in net customer withdrawals, equating to roughly 2.1% of its reported total assets. In contrast, Cryptoquant’s analytics capture broader movements, including transaction flows directly associated with the hacker and the subsequent dispersal of stolen funds. Furthermore, Cryptoquant’s stablecoin calculations specifically track Ethereum-based tokens rather than every available blockchain network, providing a targeted view of liquidity dynamics.
Alternative data providers offer supplementary perspectives on the exchange’s balance sheet status. Analytics platform Arkham Intelligence places Binance’s labeled cryptocurrency holdings at approximately $162.65 billion distributed across roughly 68.5 million distinct blockchain addresses. Arkham’s metrics as of November 8 identify approximately 696,184 BTC and 3.454 million ETH held within these tracked wallets, figures that exceed Cryptoquant’s respective estimates by roughly 22,500 BTC and 374,000 ETH.
Industry experts emphasize that such discrepancies are common within the digital asset sector. Variations in wallet attribution techniques, the breadth of blockchain coverage, and differing reporting methodologies frequently lead to divergent estimates among analytical platforms. Nonetheless, both datasets consistently document substantial reductions in exchange reserves following the October security breach.
Concurrently, external investigations continue to track the movement of the pilfered funds. Recent reports from blockchain intelligence firm Elliptic indicate that the threat actors successfully laundered and converted approximately $174 million worth of stolen alternative cryptocurrencies into an additional 2,300 BTC, thereby expanding their cumulative bitcoin holdings. On the remediation front, Binance issued an update on November 4 stating that approximately 98% of all affected user assets had been successfully replenished. Company representatives noted that efforts to complete the remaining asset replacements have been complicated by limited token liquidity across external markets.
As Binance presses forward with its phased technical restoration, the broader implications of the security breach continue to resonate across its financial architecture. While onchain flow metrics strongly suggest that the immediate wave of user withdrawals has largely subsided, the visible reduction in exchange reserves underscores the lasting financial footprint of the event. Restoring operational capabilities and rebuilding long-term user confidence remain interconnected milestones for the platform as it navigates the remainder of its recovery process.
Bitcoin & Major Altcoins
Bitcoin & Major Altcoins
Bitcoin & Major Altcoins
