Speaking at Hong Kong Fintech Week on November 3, Teng described Binance as being in “very strong financial health” and said the company could absorb the losses using its Secure Asset Fund for Users (SAFU) and corporate resources.
The comments follow the October 29 breach, one of the largest cryptocurrency thefts recorded, which forced Binance to suspend withdrawals for more than two days. The exchange has since resumed services in stages and introduced customer incentives as it attempts to restore confidence.
What Do Binance’s Latest Withdrawal Figures Show?
Binance reported $10.97 billion in withdrawals and $5.695 billion in deposits between November 1 at 06:00 UTC and November 3 at 04:00 UTC, producing cumulative net outflows of approximately $5.28 billion.
The figure represents about 3.1% of the $171 billion in assets previously reported on the exchange. Withdrawals were concentrated in the hours immediately following the reopening of services, with the initial surge gradually subsiding.
By 03:00 UTC on Tuesday, hourly deposits had begun exceeding withdrawals, according to Binance. However, the reversal covered only the latest portion of the reporting period and does not establish that cumulative outflows have stopped.
The figures extend the $3.64 billion net outflow recorded during the initial withdrawal reopening on November 1.
Competing exchanges have also experienced substantial inflows. OKX attracted approximately $445 million in net deposits over a 24-hour period on Monday, although blockchain movements alone cannot establish whether customers permanently transferred their trading activity away from Binance.
Investor Takeaway
Slowing withdrawals ease immediate liquidity pressure, but cumulative outflows and remaining service restrictions leave Binance’s recovery incomplete.
How Much of the Stolen $6.3 Billion Has Been Replaced?
Binance said on November 2 that approximately 95% of affected assets had been replenished using company resources, including its emergency protection fund. The remaining 5% consists primarily of less-liquid tokens that require additional purchases through market and over-the-counter channels.
The exchange has confirmed that ten major assets, including Bitcoin, Ether, USDT, BNB, USDC and Solana, are backed at a minimum one-to-one ratio under its latest proof-of-reserves disclosure.
Binance completed the zero-knowledge verification proof for its October 31 reserve snapshot on November 2, allowing customers to independently check the backing of their recorded balances in those assets.
However, that snapshot predates the substantial withdrawals recorded after November 1. It therefore does not independently establish the platform’s reserve position following the latest customer outflows.
Replenishing stolen assets also differs from recovering the original cryptocurrency from the attackers. Binance has committed to absorbing customer losses regardless of the outcome of its asset-recovery efforts.
The exchange plans another reserve snapshot on November 4, covering additional tokens, followed by updated verification calculations.
Why Is North Korea Rejecting the FBI’s Attribution?
The FBI formally attributed the October 29 theft to North Korea‘s TraderTraitor operation on October 31, identifying the group as responsible for stealing more than $6 billion in cryptocurrency from Binance.
The agency said investigators had observed the attackers converting stolen assets primarily into Ether before potentially moving them through decentralized finance protocols and instant-swap services.
The attribution followed earlier blockchain investigations linking the Binance attack to North Korean hacking operations, including the Lazarus-associated TraderTraitor group.
North Korea rejected the US findings on Tuesday. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, characterized the allegations as “absurd rhetoric” in a statement carried by state news agency KCNA.
She accused Washington of using the incident to portray North Korea as responsible for international cybercrime. The denial does not alter the FBI’s attribution, although no judicial finding establishing responsibility has been reported.
The FBI, alongside the US Secret Service and IRS Criminal Investigation, has urged exchanges, blockchain infrastructure operators and decentralized finance services to block transactions involving addresses associated with the stolen funds.
Those efforts could become important to the financial outcome of the incident. Blockchain investigators have documented extensive laundering activity involving cross-chain transfers, automated transactions and thousands of intermediary wallets, complicating efforts to freeze and recover assets.
Investor Takeaway
Binance’s commitment to cover losses protects customer balances, but the scale of the theft makes reserve verification and asset recovery separate priorities.
What Comes Next for Binance and Its Customers?
Binance expanded withdrawal availability across additional assets and blockchain networks beginning at 04:00 UTC on November 3. The reopening remains progressive, with individual assets subject to security checks and possible processing delays.
The exchange has also launched a customer appreciation campaign running through November 21, offering eligible users trading-fee rebates, volume-based rewards and promotional yields on selected products.
Meanwhile, the company has promised a detailed technical post-mortem once its investigation is complete. Earlier disclosures linked the suspected compromise to a developer workstation, although the full attack sequence and security failures have not yet been publicly established.
The immediate test is whether Binance can complete the remaining asset replenishment while restoring unrestricted withdrawal access. The November 4 reserve snapshot and the promised incident report will provide more concrete evidence of its recovery than short-term improvements in deposit activity alone.
