Binance Faces KSh613 Billion Outflows After KSh819 Billion Wallet BreachBinance Faces KSh613 Billion Outflows After KSh819 Billion Wallet Breach

Reuters reported on 2 November that Binance said customer outflows were stabilising and that KSh351 billion (US$2.7 billion) had flowed back into the platform since Sunday. The exchange has promised to cover the losses, while the Federal Bureau of Investigation (FBI) has attributed the attack to North Korea-linked hackers.

The incident matters to Kenyan and African customers who use Binance to hold, trade or transfer digital assets. It also raises wider questions about the safety of keeping cryptocurrency with a centralised exchange, where customers depend on the company to process withdrawals.

The Kenyan shilling conversions in this report use the Central Bank of Kenya's indicative rate of KSh129.94 to the US dollar on 2 November 2026.

What happened at Binance

In its security incident update published on 30 October, Binance said its hot wallets had been compromised, resulting in unauthorised withdrawals of approximately KSh819 billion (US$6.3 billion) in token assets.

The company said its initial investigation had suggested a compromised laptop, but later work uncovered additional points of breach. It said it had found no evidence that wallet private keys were leaked. The investigation was continuing, and Binance said it would share further technical findings once they had been verified and could be disclosed without affecting the investigation.

The FBI attributed the attack to TraderTraitor, a North Korea-linked hacking group, Reuters reported. That is the FBI's assessment and should not be confused with a completed public technical investigation by Binance.

Withdrawals return in stages

Binance began restoring withdrawals in phases on 1 November. In its recovery update, the exchange listed assets and networks included in the first phase and warned that processing could be delayed as traffic returned.

The company said it had covered about 95% of the impacted amount by that update, up from 90% in an earlier notice. It said the remaining 5% involved less liquid tokens outside the top ten assets and would take longer to source. Binance also said balances in several major assets, including Bitcoin, Ether, Tether and BNB, were fully backed.

On 3 November, Reuters reported that Binance planned to reopen withdrawals for additional assets across several networks from 04:00 GMT. The exchange said availability would be phased, and customers were advised to check the status of the specific asset and network they intended to use.

Customers pulled out billions after services returned

Reuters reported that customers withdrew a net KSh613 billion (US$4.72 billion) after the exchange reopened. Binance said the withdrawals represented about 3% of the assets on its platform and that outflows were stabilising. It also said KSh351 billion (US$2.7 billion) had flowed back since Sunday.

Those figures show that many customers moved assets after services resumed, but they do not establish that every customer was trying to leave permanently. Some withdrawals may reflect ordinary transfers, risk management or customers moving assets to other wallets and exchanges.

The return of KSh351 billion is not proof that customer confidence has fully recovered. It measures funds flowing back to the platform, not a survey of users or an independent assessment of Binance's security.

What has been frozen and what remains at risk

Binance said approximately KSh390 billion (US$3 billion) had been frozen on-chain through work with law enforcement, blockchain intelligence firms, asset issuers and other industry partners.

Those frozen assets should not be confused with the funds Binance has set aside to cover customer losses. A freeze can prevent stolen tokens from being moved, but it does not automatically mean the assets have been returned to Binance or its customers.

Reuters reported that researchers estimated hackers still controlled about KSh426 billion (US$3.28 billion) after the incident. That estimate may change as investigators trace transactions and asset issuers act on requests to freeze funds.

What the incident means for crypto users

The breach does not mean every Binance customer lost their balance. Binance has said it will cover the losses and has resumed withdrawals in phases. However, customers still need to distinguish the company's assurances from independently verified evidence about the attack, the final amount affected and the security changes made afterwards.

Users should check withdrawal availability for the specific asset and network they intend to use through Binance's official app or website. They should also be alert to fake support accounts, recovery offers and messages asking for passwords, verification codes or wallet recovery phrases. A security incident often creates opportunities for follow-on scams targeting worried customers.

The episode is a reminder that holding cryptocurrency on an exchange carries a different risk from holding it in a wallet controlled by the user. An exchange can provide convenience and access to trading, but customers remain dependent on its security, internal controls and ability to process transfers.

Mwenendo has previously examined the role of digital financial services in Kenya in its report on Safaricom's KSh1.247 trillion contribution to the economy. Binance operates in a different part of finance, but both cases show how much users depend on the systems that hold and move their money.

The next test for Binance is whether it can publish a clear technical account, demonstrate that the new controls work and provide a final, independently credible picture of the assets affected, frozen and recovered. The exchange's promise to cover customer losses is significant. Restoring trust will require evidence that the security weakness has been fixed.