Binance Customers Pull a Net $5.28 Billion After Record Hack as Half Its SAFU Bitcoin Is Spent

Crypto
Written by Methodical Millions
Illustration of a glowing vault door releasing streams of coins beside a half-full emerald reserve tank marked with a shield.

Customers withdrew nearly $11 billion USD in 46 hours after the exchange reopened, and Binance used half the bitcoin in its user-protection fund to cover the theft. Here is where the world's largest crypto exchange stands five days after the biggest hack on record.

By Methodical Jon | November 3, 2026

Binance customers withdrew $10.97 billion USD in crypto in the 46 hours after the exchange reopened withdrawals, while depositing $5.69 billion USD, for a net outflow of $5.28 billion USD, according to data CEO Richard Teng shared on Tuesday, November 3rd 2026, as reported by CoinDesk. A Binance spokesperson separately told the BBC that a net $4.72 billion USD had left since transactions resumed on Sunday, out of roughly $157 billion USD in total assets.

At the same time, public blockchain data shows Binance spent about half of the bitcoin in its Secure Asset Fund for Users (SAFU) to help cover the October 29 hack, per CoinDesk and Crowdfund Insider.

What happened

The pressure peaked on Sunday, November 1st, the day withdrawals reopened. In the worst single hour, $1.24 billion USD left the exchange and net outflows hit $936 million USD, CoinDesk reported. By 03:00 UTC on Tuesday (10 p.m. ET Monday), hourly deposits were running about $10 million USD ahead of withdrawals. "The trend is starting to show more positive inflows with hourly deposits exceeding withdrawals," Teng wrote. CoinDesk notes that not every withdrawal can be blamed on the hack, since some is normal trading activity.

On the funding side, the SAFU wallet Binance publishes held about 15,000 BTC in February. After four transactions on October 31, it holds just over 7,500 BTC, worth roughly $580 million USD at about $77,000 USD per coin, according to CoinDesk. Binance has said it covered the loss with part of SAFU, part of its futures insurance fund and its corporate treasury, and has pledged to refill SAFU to about $1 billion USD. It hasn't given a timeline.

Meanwhile, North Korea denied any role. Kim Yo Jong, sister of leader Kim Jong Un, called the U.S. attribution "absurd rhetoric," the BBC reported, and AP said Pyongyang dismissed it as "a trite provocation." The FBI has attributed the theft of more than $6 billion USD to the North Korean group it calls TraderTraitor.

How the recovery is going

Blockchain analytics firm Elliptic estimates about $2.85 billion USD of the stolen funds has been frozen or seized, CoinDesk reported, largely stablecoins blocked by issuers such as Tether and Circle. Binance has put the frozen amount at roughly $3 billion USD, per Crowdfund Insider. The rest, mostly bitcoin and ether, can't be frozen by an issuer.

Binance founder Changpeng "CZ" Zhao, who no longer runs the company, told CoinDesk he expects more attacks on exchanges and banks as AI tools spread. "The industry needs to use AI to prevent AI hacks," he said. Investigators haven't found evidence that AI was used in this attack, though. Elliptic said the laundering looks automated but shows no sign of an AI agent making decisions.

Why it matters

Two numbers tell the story. The first is $5.28 billion USD, a large figure that is still a small slice of a balance sheet Binance puts at around $157 billion USD. That is the case for calm: the doors opened, people who wanted out got out, and by Tuesday more was coming in each hour than going out.

The second is the half-empty SAFU wallet. Binance's own FAQ says it tops the fund back up to $1 billion USD if its value falls below $800 million USD "due to BTC price fluctuations," CoinDesk notes. That rule was written for a falling bitcoin price, not for spending the fund. Until Binance refills it, the cushion meant for the next emergency is smaller than it was a week ago.

The money lesson

1. A safety fund only works if it gets refilled. SAFU did its job this week. The real test is how fast Binance rebuilds it. The same goes for your emergency fund: using it is fine, leaving it empty is the risk.

2. Watch the flow, not just the headline. The scariest number (a $936 million USD hour) and the most reassuring one (deposits beating withdrawals) came from the same week. Trends tell you more than single spikes.

3. Not your keys, not your coins still applies. Users were made whole here because Binance had the reserves. Smaller exchanges, like Brazil's Mercado Bitcoin this week, may not have that depth. Keep only what you trade on any one platform.

From the podcast

We talked about Binance's run-ins with regulators back in Episode 69 - Binance Banned, useful background on how the exchange got so big and so scrutinized. And for why a rush of withdrawals tests any institution, listen to Episode 45 - Liquidity.

What to watch next

Whether hourly deposits keep outpacing withdrawals, a timeline for refilling SAFU, Binance's next proof-of-reserves snapshot, the remaining networks still being reopened, and how much more of the stolen funds gets frozen.

At the time of writing, Binance says hourly deposits have turned positive but cumulative net outflows stand at $5.28 billion USD, and it has not given a date for refilling SAFU. This article is for informational purposes only and is not financial advice.

Sources:

Thanks for reading another Methodical Minute. To read more just like this, please subscribe below and share with someone you know.

This article may be AI-assisted and is subject to errors and omissions.

Methodical Millions https://methodicalmillions.com
Previous

Google Makes AI Opt-In for K-12 Schools, but Schools That Say No Will Lose Google Search
Next

Shopify Stock Falls as Much as 19% Premarket as Q3 Merchandise Volume and Subscription Revenue Miss