Binance reopens, but confidence cannot be switched back on

There is something uncomfortable about watching a financial business reopen its doors and discovering how many customers were waiting to leave. Binance resumed withdrawals on Sunday after a $6.3bn theft, only to see billions move off the platform within hours, according to its own figures reported by the Financial Times. Restoring access was essential, but access and confidence are not the same thing.

For customers, the immediate question is straightforward: can I get my money out? For Binance, the more difficult question is what persuades them to leave it there afterwards. A reimbursement promise may address the loss. It does not, by itself, explain why the systems protecting those assets failed or why the same customers should feel comfortable returning.

The numbers need context

Binance said it processed $4.65bn in withdrawals and $1.01bn in deposits during the first nine-and-a-half hours after services began reopening, producing net outflows of $3.64bn. Those figures describe a particular period, not a definitive total for the entire reopening. Confusing gross withdrawals with net outflows makes an already unsettling situation harder to understand.

There is also disagreement over the external estimates: Reuters reported higher figures from DefiLlama, while Binance disputed the initial tracker reading, saying it failed to account for transfers into a new company wallet. That is not an accounting footnote to brush aside. Moving assets between an exchange’s own wallets is different from customers taking their money elsewhere.

Nor does every withdrawal represent a permanent departure. Some customers may be reducing exposure, testing whether transfers work or moving assets temporarily while the investigation continues. Equally, continued deposits do not establish that confidence has been restored. The sensible approach is to watch sustained customer behaviour rather than turn the first few hours into either a declaration of survival or a prediction of collapse.

Binance’s reopening has been phased by asset and network, with the company warning that heavy demand could produce delays and longer processing times. There is a sound operational argument for caution. Reopening everything before security checks are complete would be difficult to defend, but customers need precise information about what is available and what remains restricted.

Reimbursement is not recovery

To Binance’s credit, it has committed to reimbursing affected customers and said it had assembled assets covering 95 per cent of the theft, with the remaining tokens harder to acquire because they were less liquid. That is a materially better position than asking customers to absorb the loss. It also deserves to be described accurately.

Replacing stolen assets is not the same as recovering them from the thieves. An exchange can make customers whole by using its own resources while the original funds remain beyond its control. The customer outcome may be reassuring, but the business has still suffered a loss. Reimbursement transfers the financial burden; it does not make the burden disappear.

The difficulty sourcing less-liquid tokens is instructive. Having enough money in aggregate does not necessarily mean having every asset customers are entitled to withdraw. A platform must be able to deliver the right tokens, on the right networks, in the required quantities. In a crisis, the distinction between a balance-sheet value and immediately available assets becomes rather less theoretical.

Customers should therefore expect clarity on when replacement is complete, which assets remain outstanding and how the exchange will replenish the resources used. Emergency protection is valuable precisely because it exists before trouble arrives. Once it has been drawn upon, rebuilding that protection should form part of the recovery plan, not become a question deferred until the next incident.

The security question remains

The FBI attributed the attack to TraderTraitor, a North Korea-linked hacking group it had also blamed for the $1.5bn Bybit theft in 2025. Attribution matters for investigators, but it cannot be the end of the commercial explanation. Identifying a sophisticated adversary does not answer how that adversary obtained access or why safeguards failed.

Binance’s initial investigation identified a compromised engineer’s laptop, before the company disclosed additional points of breach and a wider review of its infrastructure. Those disclosures should prompt questions, not premature conclusions. A compromised device might be an entry point, but customers need to understand how that access became authority to move assets.

The eventual investigation should explain which controls were bypassed, how transaction approval was affected and what changes have been independently tested. It need not publish a technical instruction manual for the next attacker. It does need to provide more substance than a general assurance that security has been strengthened.

For institutional customers, this should also be a test of their own due diligence. A familiar name and substantial trading activity are not substitutes for examining custody arrangements, withdrawal procedures and the legal treatment of client assets. Investment committees should ask what evidence supported their original assessment, whether the incident changes that assessment and what would trigger a reduction in exposure. These are ordinary questions in financial risk management, even when the assets being traded are described as something entirely new.

Custody is the product

For an exchange, safeguarding assets is not an optional service sitting behind the trading screen. It is part of the product customers believe they are buying. Competitive fees, abundant liquidity and an extensive choice of tokens have limited appeal if users cannot be confident that their holdings will remain available when required.

That does not mean moving everything into self-custody is a universal answer. Holding assets directly shifts responsibility for keys, transfers and recovery onto the individual, with its own possibilities for error. The practical question is which risks customers understand, which they can manage and which they are paying someone else to control.

Binance’s task is consequently larger than reopening withdrawal channels. It must demonstrate that reimbursement is complete, that the causes of the breach are understood and that corrective work has been tested. Customers may forgive a serious failure when the response is credible. They are entitled, however, to demand evidence before trusting the same arrangements again.