Binance Spot Market Share Slides to 42%, a 12-Week Low

Spot Share Slips to a 12-Week Low

Binance's grip on spot trading slipped after last week's record theft. Over the past seven days the exchange processed about 42% of spot volume across the ten largest exchanges, its weakest weekly share in at least 12 weeks. That is down from roughly 48% in the days before the October 29 breach and about 51% in mid-August. Weekly market share data shows OKX absorbed the most displaced flow, climbing to about 14% from 11% the prior week, while Coinbase edged up to 9.6% from 9% and Kraken also gained ground.

The damage traces to October 29, when attackers drained $6.3 billion from a Binance hot wallet and the exchange halted withdrawals. Withdrawals resumed in stages on November 1, and in the first nine and a half hours after the restart net outflows reached $3.64 billion. Binance had put its assets at $171 billion in a proof of reserves dated October 28; by Monday that figure had fallen to $157 billion, a decline the exchange attributed to the theft, post-restart withdrawals and price moves. A spokesperson put cumulative net outflows since the restart at $5.6 billion, about 3.5% of total assets.

The exchange is now working to hold its institutional base. On November 2 it announced a VIP tier protection program running November 3 through December 2: users in VIP levels 1 through 9 keep the highest tier they reached between October 21 and 30 even if they no longer meet the normal requirements. A community trading campaign that began Monday rewards eligible users with $10,000 in cumulative volume, and some earn products carry rates up to 10% APY. On Tuesday, Binance said hourly deposits exceeded withdrawals as of 03:00 UTC, and it opened a sixth recovery release after co-CEO Richard Teng told an audience at Hong Kong Fintech Week that 95% of the affected tokens had been filled.

Inside TraderTraitor's Playbook

The October 31 alert from the FBI attributed the theft to TraderTraitor, a North Korean hacking unit. At $6.3 billion it is the largest theft in crypto history, more than four times the $1.5 billion taken from Bybit in February 2025, an attack the FBI also pinned on the same group. It roughly doubled the more than $6 billion that TRM Labs estimated in April North Korean hackers had stolen since 2017. Pyongyang denies involvement; Kim Yo Jong, sister of leader Kim Jong Un, dismissed the finding as “absurd rhetoric.”

The name first appeared in a joint April 2022 advisory from the FBI, CISA and the Treasury Department, which described malware hidden in trading apps and attacks on exchanges, DeFi protocols and investors dating to at least 2020. Researchers also track the group as Jade Sleet, UNC4899 and Slow Pisces. Its record includes AlphaPo ($60 million), CoinsPaid ($37 million) and Atomic Wallet ($100 million) in 2023, plus the $292 million KelpDAO bridge theft in April, which LayerZero's forensic investigators assessed as its work.

The method is social engineering. In March 2024 a fake LinkedIn recruiter sent a Ginco employee a coding test laced with malware; stolen session data then let the attackers impersonate the employee and manipulate a legitimate transaction request from DMM Bitcoin, which lost 4,503 bitcoin worth $308 million and later shut down. At Binance, chief security officer Jimmy Su said a software engineer was contacted in September by someone posing as a project director, passed a staged interview process and downloaded a coding assignment onto a work machine. That malware gave the attackers access to the machine and an internal AI tool. Chainalysis said its strongest evidence ties the stolen Binance funds to proceeds of September's roughly $388 million Bitget hack.

Reading the Post-Mortem

The market's verdict is already visible in the tape. A six-point share swing in one week is unusually fast for spot venues, and it moved to rivals before Binance could complete its recoveries, which suggests institutions acted on the intrusion itself rather than the remediation timeline. The post-mortem evidence cuts the other way for the long run: this was no rug pull by an insider or a cryptographic failure, but a single employee running one malicious file, so the durable fix lies in personnel vetting and approval-layer monitoring, not a protocol redesign. The VIP guarantees and the 95% token refill cap the damage, yet winning back the withdrawn $5.6 billion depends on flows returning, and the hourly deposit data will show it first.