Key Takeaways
- Binance restored withdrawals on 87 networks and aims to reopen remaining services by the end of next week.
- The Oct. 29 attack drained approximately $6.3 billion, with roughly $3 billion subsequently frozen by third parties.
- Cryptoquant charts show approximately 688,900 BTC in Binance reserves, alongside recent negative bitcoin netflows.
Binance Restores 87 Networks as Outflows Paint a Curious Picture
Binance’s latest recovery announcement, published Nov. 14, marks another step toward restoring normal operations following the largest cryptocurrency theft reported to date. The exchange confirmed that withdrawals resumed across 87 networks this week, including Ethereum-related protocols, networks like Litecoin, Cardano, Avalanche, and numerous other blockchain platforms.
The company disclosed that it intends to restore full withdrawals across all remaining networks and assets by the end of next week, although the timetable remains a target rather than a guarantee. The largest crypto exchange by trade volume stated:
“We continue to make progress restoring withdrawal services and we will aim to reopen withdrawals for all remaining networks and assets by the end of next week.”
Customers were advised to consult the exchange’s network status page before initiating any transactions. Binance also cautioned that temporary delays and longer processing times could accompany the restoration as withdrawal activity resumes.
The announcement follows the Oct. 29 intrusion, when attackers reportedly extracted approximately $6.3 billion from Binance-controlled hot wallets spanning over a dozen blockchains. The stolen assets included roughly 167,464 ETH, approximately $1.6 billion in tether (USDT), and a myriad of additional cryptocurrencies.
According to Chainalysis, Elliptic, Bitquery, TRM Labs, and other blockchain analysts, most of the stolen funds departed Binance-controlled wallets within approximately 20 minutes. Third parties subsequently froze around $3 billion, potentially reducing the ultimate financial damage, although the final recoverable amount remains uncertain.
Investigators initially identified a compromised Devops engineer’s laptop as an entry point. Binance co-CEO Richard Teng later acknowledged additional complexities, while blockchain researchers documented the exploitation of Ethereum’s EIP-7702 authorization mechanism.
Blockchain investigators and the FBI attributed the attack to North Korea’s TraderTraitor group with high confidence. Binance maintains that customer funds remain protected and has pledged to absorb losses using its SAFU fund and corporate resources.
Cryptoquant Data Reveals Binance’s Bitcoin Reserves and Exchange Flows
Separate from Binance’s operational recovery, Cryptoquant’s onchain metrics provide an intriguing perspective on bitcoin movements associated with the exchange. The latest figures show substantial fluctuations in exchange netflows, alongside considerable bitcoin reserves that have remained elevated despite recent market turbulence.
The netflow chart reveals pronounced negative readings during the start of November, including an exceptionally large daily withdrawal imbalance approaching 22,000 BTC. The activity cooled, and the latest displayed netflow this weekend stands near negative 485.7 BTC, with bitcoin prices trading around $66,700 per coin.
Essentially, netflow measures exchange inflows minus outflows. Negative readings indicate more bitcoin leaving exchange-associated wallets than entering them, although the metric cannot independently distinguish customer withdrawals from internal transfers or other operational activity.
Meanwhile, Cryptoquant’s longer-term charts display approximately 2,300 BTC in daily outflows and 1,800 BTC in inflows at their latest observations. Both measures are substantially below several historical extremes, including extraordinary transaction spikes recorded during previous market cycles.
Perhaps more noteworthy is Binance’s exchange reserve balance, which Cryptoquant places near 688,900 BTC (other analytics sites carry different reserve numbers for Binance). Cryptoquant’s historical series illustrates substantial reserve accumulation since 2019, with balances fluctuating considerably throughout 2025 and the final quarter of 2026.
Ultimately, restoring withdrawal functionality represents measurable operational progress, but it does not conclude the security investigation. Binance must still demonstrate that its infrastructure is secure, remaining services are restored, and that customers can reliably access their assets. The distinction between resumed operations and fully resolved financial exposure remains central to evaluating its recovery.
