Binance spot share falls to 42% after $6.3B hack, OKX gains

What happened

Binance accounted for about 42% of spot crypto trading across the top 10 exchanges in the seven days after a $6.3 billion breach, down from roughly 48% before the hack and about 51% in mid-August, according to Kaiko data reported by Bloomberg and cited by CryptoPotato. That was Binance's lowest weekly share in at least 12 weeks.

Rivals picked up activity. OKX's share rose to about 14% from roughly 11% a week earlier on higher spot volume, while Coinbase climbed to 9.6% from about 9%. Kraken also gained share, the same data set showed. The shift followed the Oct. 29 attack, in which attackers drained $6.3 billion from Binance hot wallets and the exchange suspended withdrawals.

Binance reopened withdrawals in phases on Nov. 1. That day it reported $171 billion in assets based on its Oct. 28 proof of reserves, and net outflows reached $3.64 billion in the first nine and a half hours. By Monday, a spokesperson told Bloomberg, assets stood at $157 billion, an internal estimate that accounts for the hack, subsequent withdrawals and price moves. Net outflows since reopening totaled $5.6 billion, or about 3.5% of total assets, the spokesperson said.

On Tuesday, Binance said hourly deposits had overtaken withdrawals by 03:00 UTC. It also reopened withdrawals for more assets in a sixth recovery phase after co-CEO Richard Teng told a Hong Kong Fintech Week event that 95% of affected tokens had been replenished, according to CryptoPotato.

Why it matters

Spot market share is a closely watched measure of trading activity, and the drop suggests some users and market makers shifted business to competitors after the breach. Binance founder Changpeng Zhao framed the incident as a broader financial stability issue: stablecoins, tokenized securities and real-world assets have tied crypto more closely to banks and sovereign debt markets, making a major exchange hack a matter beyond one company. He said the impact reaches industry and global finance and is at national security level, according to Bitcoin.com News. He also warned that AI tools used by attackers are improving faster than defenses available to financial firms, a gap that could slow mainstream adoption and expose traditional banks as well.

What the data shows

Kaiko's figures put Binance at about 42% weekly spot share, versus about 48% before the hack and about 51% in mid-August. OKX rose to about 14% from about 11%, Coinbase to 9.6% from about 9%, and Kraken also gained. Binance's stated assets fell from $171 billion on Nov. 1 to $157 billion by Monday, with net outflows of $5.6 billion since reopening, about 3.5% of total assets. The exchange said 95% of affected tokens had been replenished as of Teng's Tuesday remarks. Binance also announced a VIP Level Protection Program for eligible VIP levels 1 to 9, automatically enrolled, that preserves the highest level reached between Oct. 21 and Oct. 30 under a program running Nov. 3 to Dec. 2. A separate community appreciation campaign includes rewards for eligible users who reach $10,000 in cumulative trading volume, with annual rates on some yield products as high as 10%.

Background

The FBI attributed the Oct. 29 theft to North Korea's TraderTraitor group on Oct. 31, and blockchain analytics firm Elliptic said its analysis supported that conclusion. North Korea rejected the allegation on Tuesday. In his first interview since the hack, Zhao told the Talking Tokens Podcast that crypto firms now face several attacks a day as AI helps hackers automate reconnaissance, phishing and vulnerability discovery. He called for government support and an industry-wide security alliance that could share audit findings, exchange lessons and coordinate faster asset freezes, Bitcoin.com News reported. Zhao said Binance's decision to cover all losses helped prevent a wider crisis, but he acknowledged the attack was preventable and warned that institutional complacency remains a serious risk.

What is still unclear

Two points remain contested or provisional. North Korea rejected the FBI's attribution, even as Elliptic backed it, so responsibility is still publicly disputed. Binance's $157 billion asset figure is an internal estimate that incorporates the hack, withdrawals and market moves, rather than a new proof-of-reserves snapshot; the $171 billion figure was based on an Oct. 28 proof of reserves.

What to watch

Market participants will watch whether Binance's spot share stabilizes after the exchange reported deposits exceeding withdrawals. Also in focus is whether Zhao's proposed security alliance attracts support from U.S. and Chinese authorities, and whether exchanges adopt stronger AI defenses. Binance's next reserve disclosure and the pace of the remaining withdrawal recoveries will be additional tests, as will any response to North Korea's denial.

Questions readers ask