Binance Lost $14 Billion in a Week — But the Money Didn't Vanish: Where It Actually Went

In the week after the largest crypto theft on record, trackers counted nearly $14 billion flowing out of Binance — while Binance itself says $5.8 billion has left since withdrawals reopened. Both numbers can be true at once, and the gap between them tells you more about where your crypto actually is than either figure alone. This is the story of where the money went, who received it, and the scam now targeting everyone moving coins in a hurry.

Binance, the world's largest crypto exchange, was hit on October 29, 2026, when hackers drained roughly $6.3 billion from its hot wallets. The FBI attributed the theft to TraderTraitor, North Korea's state-sponsored hacking unit, the same operation blamed for the $1.5 billion Bybit theft in early 2025. Binance suspended withdrawals, then reopened them in phases from Sunday, November 1 — and customers immediately started voting with their wallets.

What happened next was not a simple bank run. It was a week of violent swings: billions out, then billions back in, then billions out again. Understanding that pattern matters, because the same forces — fear, self-custody, rival exchanges, and opportunistic scammers — decide whether your own coins are safe on any exchange, not just this one.

What actually happened: the hack, the freeze, and the reopening

Binance's early investigation pointed to a compromised DevOps engineer's laptop as the entry point, rather than a leaked wallet key. That detail matters: it suggests the attackers got in through a person and a machine, not by breaking cryptography. The exchange said it would absorb the loss itself, using its Secure Asset Fund for Users (SAFU) — a reserve of about $1 billion in bitcoin — plus its corporate treasury and its futures insurance fund, buying back replacement tokens. By November 1 it said roughly 95% of the affected assets had been replenished, up from about 90% the day before.

Withdrawals reopened in phases. The first phase, from 06:00 UTC on Sunday, November 1, covered 15 networks and major assets including Bitcoin, Ethereum, BNB, Solana, XRP, Dogecoin, USDT and USDC. A second phase opened at 04:00 UTC on Tuesday, November 3, releasing more assets as security checks finished, and US dollar withdrawals have since been restored. Binance has not put a date on later phases or said which assets remain unavailable — the restoration is still phased, not complete.

On the first day alone, Binance processed about $4.65 billion in gross withdrawals against $1.01 billion in deposits in the first nine and a half hours — a net outflow of about $3.64 billion by the exchange's own count, or $4.72 billion on a later spokesperson figure reported by Reuters. The difference between those two numbers is itself a lesson: outflow figures move as the counting window and methodology change, and no single headline number is the full story.

The $14 billion week: a timeline of the swings

Here is how the week unfolded, combining Binance's own statements with independent wallet trackers. Treat the tracker figures as estimates — they are built by watching wallets analysts believe belong to Binance, not from Binance's internal books, and Binance's co-CEO Yi He has noted that some counted transfers were movements between Binance's own wallets rather than customer withdrawals.

When	What happened	Figure
Oct 29	Hack drains hot wallets; withdrawals suspended	~$6.3 billion stolen
Oct 30–31	Binance commits company funds to cover the loss	~$6.34 billion committed; ~90–95% replenished
Nov 1 (first 9.5 hours)	Withdrawals reopen on 15 networks; customers pull funds immediately	$4.65 billion out vs $1.01 billion in
Nov 1 (full day, tracker view)	DefiLlama measures a full-day net outflow	~$4.05 billion net
Nov 2–3	Second withdrawal phase opens; flows reverse briefly	Two days of net inflows: $2.3 billion, then $1.82 billion
Later in the week	Flows swing back out sharply	$4.54 billion net outflow in a day; $5.14 billion single-day tracker peak
Week total	Binance's own count vs tracker estimates	$5.8 billion (Binance) vs ~$14 billion (trackers)

The most important row in that table is the reversal. Two days of multi-billion-dollar inflows followed the initial exodus. That is not what a collapsing exchange looks like — it is what a stressed but functioning one looks like, with traders returning, arbitrageurs moving funds, and some customers deciding the exchange's promise to absorb the loss was credible after all. Then the flow swung out again by $4.54 billion. Confidence, in other words, has not settled. It is oscillating, day by day, and Bitcoin's own price reflects that fragility: BTC traded around $78,000 on November 4, roughly 38% below its $126,156 all-time high, after dipping to $75,736 overnight.

Why the $5.8 billion and $14 billion figures disagree

Readers are right to ask how two counts of the same event can differ by more than $8 billion. There are three honest reasons, and none of them requires anyone to be lying.

First, gross versus net. A tracker counting every coin leaving a Binance-labelled wallet will record a much bigger number than a net figure that subtracts deposits arriving in the same window. Second, attribution. Trackers label wallets by inference; Binance knows which wallets are actually customer funds, which are corporate treasury, and which are internal transfers between its own wallets. Third, the window. Binance's $5.8 billion figure counts outflows since withdrawals reopened on its own books, while the roughly $14 billion tracker figure spans a week of gross movement across a changing set of labelled wallets. The truth for an individual customer is narrower than either number: what matters is whether your balance is withdrawable today, not what the aggregate flow was last Tuesday.

Put the outflow in proportion, too. Binance measures the first day's net outflow at about 2.1% to 2.8% of the roughly $171 billion in customer assets it reports holding. That is a serious confidence shock, not an existential drain — and it is exactly why the exchange could keep processing withdrawals while absorbing a $6.3 billion theft. The danger sign to watch would be the opposite pattern: outflows accelerating day after day with no inflow days at all. That has not happened.

Where did the money actually go? Four destinations

Outflow trackers can see coins leaving Binance-labelled wallets, but they cannot always see the motive. The evidence points to four main destinations, and your own decision should depend on which one fits your situation.

Destination	Evidence	What it means for you
Self-custody wallets	The classic post-hack move: holders take their own keys after an exchange breach	No counterparty risk, but you become your own bank — lose the seed phrase and the coins are gone
Rival exchanges	OKX took in $316.8 million on the first day alone, per DefiLlama	Swapping one custodian for another; check proof of reserves and withdrawal history first
Stablecoins and cash	Part of the flow converted to USDT/USDC or exited to dollars as USD withdrawals reopened	Reduces volatility exposure but adds issuer and banking counterparty risk
Back to Binance	Two inflow days of $2.3 billion and $1.82 billion	Some traders returned for liquidity, derivatives, or because they believed the loss-absorption promise

The self-custody share is the hardest to measure precisely, which is why it is also the most overstated in social media. Not every coin that leaves an exchange goes to a hardware wallet; much of it lands on another exchange, in a trading wallet, or in a stablecoin position that is still custodied somewhere. If you are considering the move yourself, read our guide to storing crypto safely with cold storage and seed phrases and compare the best hardware wallets of 2026 before you send anything — the most expensive mistake in a panic move is sending coins to the wrong network.

What most people get wrong about this story

Three myths are circulating, and each one could cost you money if you act on it.

Myth 1: "Binance is insolvent because billions left." An outflow is not a balance sheet. Binance says it replaced roughly 95% of the stolen assets from its own capital and that outflows represent under 3% of customer assets. Insolvency would look like frozen withdrawals that never reopen, not phased withdrawals processing billions a day. That does not make Binance risk-free — it makes the current evidence a confidence story, not a solvency verdict.

Myth 2: "Moving to self-custody makes you safe." Self-custody removes exchange counterparty risk and replaces it with personal security risk: phishing, fake wallet software, blind signing, and lost recovery phrases. The week of the hack also produced a wave of fake "$150 reward" messages claiming compensation for the withdrawal pause. Binance has announced no such payout and no refund process that asks for passwords, verification codes, or wallet credentials. Anyone offering you a reward for the pause is running a scam, full stop.

Myth 3: "The hack is over because withdrawals reopened." The laundering and investigation continue, the phased restoration is incomplete, and the outflow swings show confidence has not stabilized. The FBI attribution to a North Korean state unit also means this was not an opportunistic theft but a campaign — the fake job interview lure that reportedly opened the door is a technique that targets people, not code, and it will be reused.

The scam riding on the panic: fake "$150 reward" messages

On the morning withdrawals reopened, fake screenshots began circulating promising a $150 reward for the withdrawal pause, directing users to a "reward hub" link. There is no such compensation. Binance's actual message was that it would absorb the financial impact of the stolen funds, not that it would pay users a reward for waiting. The scam works because it arrives at exactly the moment victims are checking their balances most anxiously.

Never click a reward link sent after an exchange incident, never enter a seed phrase or verification code anywhere except the official app or site you navigated to yourself, and treat any message claiming a refund process as fake until the exchange announces it on its verified channels. For the full picture of how the attack itself worked, see our explainer on how hackers turned Binance's own AI tool against it, and check how to verify your balance in the November 4 proof-of-reserves snapshot — including the 5% it still does not cover.

Checklist: before you move your crypto anywhere

• Confirm the asset and network are actually supported for withdrawal right now, since restoration is still phased and some assets remain unavailable.
• Send a small test transaction first, especially if you are moving to a new wallet or exchange, and confirm it arrives before sending the rest.
• Double-check the destination address character by character, and confirm whether a memo or tag is required for that asset.
• Verify you control the receiving wallet's recovery phrase, stored offline, before you depend on it for life-changing sums.
• Ignore every "reward," "refund," or "compensation" link tied to the hack — Binance has announced no such payout.
• Check the exchange's proof-of-reserves snapshot and its withdrawal history, not just its marketing, before trusting a new custodian.
• Keep a record of what you moved, when, and where, for tax purposes — the 2026 tax-loss harvesting deadline is December 31, and chaotic moves create chaotic records.

What happens next: 5 signals to watch

First, whether the daily flow stabilizes. More inflow days would signal returning confidence; another $4 billion-plus outflow day would signal the opposite. Second, the proof-of-reserves report: independent verification matters more than a company statement, and the November 4 snapshot still leaves questions open. Third, the laundering trail — investigators have already traced large movements, and frozen funds change the recovery picture. Fourth, regulation: South Korea has already moved toward a 99% cold wallet rule after the hack, and other regulators will follow with custody requirements that affect every exchange you use. Fifth, the macro backdrop: US Bitcoin ETF outflows slowed to $115.56 million on Tuesday from $398.62 million on Monday and $643.33 million on Friday, suggesting selling pressure is easing as Bitcoin steadies near $78,000 — but Ether ETFs extended their losing streak to seven sessions with another $85.35 million out, so the institutional mood is far from uniformly positive.

None of this is a reason to panic-move your coins today, and none of it is a reason to ignore the warning either. The rational response to a $6.3 billion hack at the world's largest exchange is boring and specific: verify your balance, decide deliberately where your coins should live, move them carefully if you move them at all, and ignore anyone offering you free money for the trouble.

Frequently asked questions

How much money actually left Binance after the hack?

Binance says $5.8 billion has left since withdrawals reopened. Independent trackers counted roughly $14 billion in outflows across the week, with a single-day peak around $5.14 billion. The gap reflects different methods: Binance counts net customer outflows on its own books, while trackers count gross movements from wallets they attribute to Binance, including internal transfers.

Is Binance insolvent?

There is no public evidence of insolvency. Binance says it covered the roughly $6.3 billion theft from its own treasury, SAFU reserve, and insurance funds, replenishing about 95% of affected assets, and that outflows equal under 3% of its reported $171 billion in customer assets. Withdrawals are processing in phases. That is evidence of a confidence shock, not proof of solvency — only an independent audit could settle the question fully.

Where did the withdrawn crypto go?

To a mix of self-custody wallets, rival exchanges (OKX alone took in $316.8 million on day one), stablecoin positions, and cash — and some of it came back, with two days of net inflows worth $2.3 billion and $1.82 billion. No tracker can attribute every coin, so claims that "all" of it went to any single destination should be treated with suspicion.

Should I move my crypto off Binance now?

That depends on your situation, not on the headlines. If you trade actively, you need exchange liquidity; if you hold long-term, self-custody removes counterparty risk but adds personal security responsibility. Whatever you decide, move deliberately: test transaction first, correct network, offline seed-phrase backup, and no clicks on reward or refund links.

Is the "$150 Binance reward" real?

No. It is a scam circulating since withdrawals reopened. Binance has announced no compensation payout for the withdrawal pause and no refund process requiring passwords, verification codes, or wallet credentials. Report and ignore any message offering one.

Are Binance withdrawals fully back to normal?

Not yet. Withdrawals reopened in phases from November 1, with a second phase on November 3 and US dollar withdrawals restored since, but Binance has not dated the remaining phases or listed which assets are still unavailable. Check the status of your specific asset before assuming you can move it.

Conclusion

Nearly $14 billion in tracker-counted outflows, $5.8 billion on Binance's own count, two days of billion-dollar inflows in between, and a fake reward scam feeding on the confusion — the week after the $6.3 billion hack was not a bank run and it was not a clean recovery. It was a stress test, and it is still running. The customers who come out of it best will not be the ones who moved fastest. They will be the ones who verified their balances, chose their custodian deliberately, moved their coins carefully, and ignored the scammers offering them $150 for their trouble. Sources for the figures in this article include Tech Insider's outflow analysis, Cryptobase's $5.8 billion report, AInvest's coverage of Binance's loss absorption, and Bitcoin.com's ETF outflow data.