Markets
After the Binance shock, what withdrawal and deposit flows really reveal
Four days after the largest hack in the history of crypto assets, withdrawal and deposit data on Binance depict a fragile rebalancing, far from a full return to normal. Liquidity remains noticeably depleted, a sign of trust still under strain toward major centralized platforms.
On October 29, 2026, Binance suffered a theft estimated at about 5,65 milliards € (6,3 milliards USD), presented as the largest hack in the history of crypto assets. According to initial elements reported by the company and U.S. authorities, the attack would be linked to a North Korean group associated with the “TraderTraitor” campaign. Part of the funds was moved in less than 20 minutes, illustrating the industrial scale of these operations and the difficulty for platforms to react in real time.
In the hours and days that followed, the priority was to contain the capital outflow. According to on‑chain analyses published at the end of October and beginning of November 2026, about 2,69 milliards € (3 milliards USD) of stolen assets were frozen in transit by blockchain partners. This interception reduces Binance’s net exposure, without erasing the initial shock: even when frozen, these funds remain immobilized and feed regulatory, judicial and operational uncertainty about their final outcome.
User reaction materialized when withdrawals reopened on November 1, 2026. According to several specialized press reports, nearly 3,23 milliards € (3,6 milliards USD) additional were withdrawn from the platform in a short time. This rapid exit movement reflects a classic counterparty risk reduction reflex after an extreme security incident. It shows that, despite Binance’s size, a significant portion of the customer base chooses to self‑insure by withdrawing to external wallets.
On November 3, 2026, Binance indicated that deposits were beginning to exceed withdrawals again, while acknowledging a cumulative net negative flow of about 4,48 milliards € (5 milliards USD) since the hack. This partial reversal of flows does not mean the trust crisis has been erased: it rather suggests a sorting between users ready to stay or return, and those who now favor off‑exchange custody. For the sector as a whole, these figures increase pressure in favor of more transparent security audits and more frequent, verifiable proof‑of‑reserves mechanisms.
At the market level, this type of shock rekindles debates about the concentration of liquidity on a few centralized actors. The fact that flows of several milliards euros can reverse in a few days reveals both the technical resilience of infrastructures and their reputational vulnerability. Withdrawal and deposit data in the coming weeks will be scrutinized: they will make it possible to distinguish a mere short‑term reflex from a potential lasting movement toward self‑custody solutions and decentralized finance, in a context where neither liquidity nor trust can be taken for granted any longer.