Binance is seeing a sharp rebound in user activity after last week’s major incident, with net inflows of $2.3 billion recorded over the past 24 hours as withdrawals continue to be rolled back in phases. Data tracked by DefiLlama shows centralized exchanges overall returning to positive flow, a notable change from Monday’s heavy outflows.
According to DefiLlama’s figures for 24-hour net inflows, Binance leads with $2.3 billion. Bitfinex recorded roughly $280 million, while Bitget logged about $127 million during the same period—signals that traders and depositors are moving funds back to exchanges after the disruption.
Key takeaways
- Binance posted $2.3B in 24-hour net inflows, reversing part of the pressure from Monday’s outflows.
- DefiLlama data places Binance ahead of other centralized exchanges, with Bitfinex at about $280M and Bitget around $127M.
- Binance said hourly deposits were exceeding withdrawals by 03:00 UTC, indicating improving flow stability.
- Withdrawals were suspended after a reported $6.3 billion hack, then restarted in phases starting Sunday and expanded for some fiat currencies on Monday.
- Binance claims it has replaced about 95% of affected assets and says it will cover remaining losses via company resources and protection funds.
From withdrawals freeze to improving net flows
The latest inflow numbers highlight a turnaround in exchange liquidity. Binance’s improvement comes after a period when users pulled funds off centralized platforms rapidly.
Earlier in the week, Cointelegraph reported that Binance saw more than $7 billion in net outflows over 24 hours on Monday, with OKX leading the broader sector during that same window with about $445 million in net inflows. The contrast underscores how sensitive centralized exchange flows can be to operational disruptions, especially when withdrawals are paused.
Binance itself pointed to the change in real time. On Tuesday, the exchange said that “by 03:00 UTC, we are seeing hourly deposits exceed withdrawals, reflecting improving user activity and stabilizing flows,” as posted on X.
Why Binance’s recovery hinged on withdrawals restarting
Binance suspended withdrawals on Friday following Thursday’s reported $6.3 billion hack, according to earlier coverage linked in the article. The suspension remained in place while the exchange investigated the breach and ran security checks.
Binance began restoring withdrawals at 06:00 UTC on Sunday and later reopened withdrawals for some fiat currencies on Monday, Cointelegraph reporting that outflows started to slow down as access returned.
That staged approach appears to have influenced user behavior. When withdrawals are restricted, even deposits can become a weaker signal because funds may be “stuck” on platforms. As restrictions ease, deposits can translate more readily into balanced net flow—something Binance’s own statement about hourly deposits exceeding withdrawals suggests is underway.
Binance’s asset replacement plan and remaining exposure
In its Sunday recovery update, Binance said it had replaced approximately 95% of the affected assets. The remaining 5% involves less liquid tokens, which the exchange said require more time to acquire through market operations and over-the-counter purchases.
Beyond the operational update, Binance also pledged to cover losses using company resources and protection funds rather than passing the burden to customers. For market participants, this matters because it frames how exchange recovery costs could—or could not—translate into customer-facing constraints or reputational fallout. While blockchain transactions can reveal what happens to funds at the protocol level, exchange recovery strategies determine how quickly trading and custody functions normalize for users.
Geopolitical dispute remains part of the backdrop
The hack has continued to draw geopolitical scrutiny. On Saturday, the US Federal Bureau of Investigation attributed the attack to North Korea, as reflected in earlier Cointelegraph reporting. North Korea denied involvement on Tuesday, with Kim Yo Jong—reported as the sister of North Korean leader Kim Jong Un—describing the accusation as “absurd rhetoric.”
While neither the attribution dispute nor the denial changes the immediate mechanics of Binance’s withdrawals restart, it can affect broader perceptions of risk across centralized platforms. In recent years, such incidents have often triggered concerns about whether exchanges can sustain security and operational continuity under sustained threat.
What to watch next for exchange flow stability
Traders and investors will likely focus on whether Binance’s deposits-versus-withdrawals balance holds consistently after each withdrawal phase, and whether the remaining unreplaced 5% of affected assets is fully secured without further delays. If net inflows persist, it would suggest confidence is returning; if outflows re-accelerate, it could indicate unresolved concerns about custody, timing of repayments, or security posture.
