Binance Restores HYPE and APT After $6.3 Billion Hack

By Marcus Bennett

Cryptoquant data show Binance’s bitcoin reserves fell by roughly 56,000 BTC after the exchange’s $6.3 billion Oct. 29 hot-wallet hack, even as Binance restored HYPE and APT withdrawals.

Cryptoquant metrics examined through Nov. 8 show the reserve decline. Blockchain investigators and U.S. authorities attributed the attack to North Korean hackers. The theft removed approximately $6.3 billion from hot wallets across multiple blockchains and ranks as the largest cryptocurrency theft recorded in dollar terms.

On Sunday, a short Binance notice offered the clearest sign of operational progress:

“Latest Withdrawal Update. Withdrawals have now been re-enabled for the following networks and assets: $HYPE, $APT.”

The Nov. 8 notice came after the exchange committed on Nov. 6 to restore withdrawals for HYPE, APT, INJ, PLASMA, NEAR and LTC by the end of the following week. HYPE and APT returned ahead of that schedule. The other routes remain subject to individual security assessments.

What does the service restart change for customers?

The immediate practical change is access, not a full repair of the exchange’s balances. Customers can again withdraw HYPE and APT. Binance had resumed withdrawals for major cryptocurrencies across 15 networks on Nov. 1, then expanded support to dozens of additional assets, including tokens on Ethereum and Solana.

Although the restoration reduces withdrawal friction, it does not mean every route has reopened or that Binance has rebuilt its pre-attack reserves. The next test comes with the remaining assets promised for the end of the following week.

Reserves tell a harsher story

Cryptoquant’s bitcoin series shows reserves falling from about 730,000 BTC before the attack to 673,700 BTC. That is a roughly 7.7% decline. At bitcoin’s Sunday price of $75,800, the difference represents about $4.2 billion.

Between late October and early November, the sharpest daily netflow readings were approximately negative 14,500 BTC, 22,000 BTC, 16,500 BTC and 9,000 BTC. The 22,000 BTC session was the largest daily net outflow in the available 12-month statistics. A positive 10,400 BTC session followed, and the latest reading showed positive netflows of about 1,300 BTC. The initial selling and withdrawal pressures were easing, but the reserve balance remained lower.

Ethereum reserves fell from about 3.48 million ETH to 3.08 million ETH, a reduction of 400,000 ETH, or 11.5%. Two daily readings approached negative 175,000 ETH and negative 155,000 ETH. The latest daily figure remained negative at roughly 5,500 ETH.

The pattern across major Ethereum-based stablecoins was more severe proportionally, with reserves falling from approximately $41 billion before the attack to $32 billion by Nov. 8. The $9 billion contraction equaled 22%.

Two daily stablecoin outflows approached $3.3 billion and $3.6 billion, roughly triple the largest comparable daily withdrawal previously recorded in 2026. The latest reading turned positive at about $27.9 million, indicating that the extraordinary activity had moderated.

These measurements do not equate to Binance’s previously reported $3.64 billion in net customer withdrawals, equal to about 2.1% of reported assets. Cryptoquant includes movements tied to the theft and the Binance hacker, and its stablecoin series covers Ethereum-based tokens rather than every blockchain. The reserve picture therefore combines customer activity with attacker-related transfers.

Different ledgers, same direction

At the time of writing, Arkham Intelligence placed Binance’s labeled cryptocurrency holdings at approximately $162.65 billion across 68.5 million addresses. Its Nov. 8 data showed roughly 696,184 BTC and 3.454 million ETH, exceeding Cryptoquant’s figures by about 22,500 BTC and 374,000 ETH.

Although Arkham’s totals sit above Cryptoquant’s estimates because wallet attribution, blockchain coverage and reporting methods differ, both datasets point in the same post-attack direction. Arkham measures labeled holdings, while Cryptoquant’s reserve estimates provide a different view of balances associated with the exchange.

Elliptic reported that the attackers converted about $174 million in stolen alternative cryptocurrencies into another 2,300 BTC. On Nov. 4, Binance said it had replenished approximately 98% of affected assets. Limited token liquidity complicated purchases of the remainder. That replenishment rate does not erase the outflows visible in reserve data, and available evidence does not establish that either operational recovery or the restoration of confidence is complete.

The next deadline is Binance’s promised end-of-following-week restoration for INJ, PLASMA, NEAR and LTC, subject to individual security reviews.