Binance users pull $3.6bn as exchange reopens after $6.3bn hack

Key Points

1. Binance customers withdrew a net $3.6bn on Sunday as the exchange resumed trading after the breach.
2. The attack hit $6.3bn in digital assets; the FBI and others blame North Korea.
3. Binance says it has covered about 95% of stolen funds from its own reserves.

The latest:

Net withdrawals of roughly $3.64bn hit Binance on Sunday as the world’s largest cryptocurrency exchange reopened following a breach of $6.3bn in digital assets, believed to be the biggest hack on record. The company said it processed $4.649bn in withdrawals against $1.01bn in deposits between 06:00 and 15:30 GMT on 1 November, and described outflows as stabilising after an initial spike.

Details:

• The numbers: Binance said on X that withdrawals reached $4.649bn and deposits $1.01bn during the nine-and-a-half-hour window, producing a net outflow of about $3.64bn. The firm said that figure represents just over 2% of the $171bn in assets it manages, and that withdrawals spiked early before declining.
• The coverage: The exchange said it has replaced roughly 95% of the stolen assets, drawing on its corporate treasury, futures insurance fund and emergency reserves. Binance said last week it had set aside more than $6.3bn to handle the fallout, and has repeatedly pledged to fully cover the financial impact on customers.
• Still outstanding: Binance said the remaining portion of the stolen assets may take longer to source. The company did not give a timeline for closing that gap, nor did it specify which assets remain unreplaced after the first wave of reimbursements.
• Who is blamed: The FBI and other major organisations have accused North Korea of carrying out the attack. It has been attributed to TraderTraitor, the North Korean cybercrime group also known as Lazarus, which stole a then-record $1.5bn from rival exchange Bybit in 2025.
• The FBI step: The bureau published on Saturday a list of cryptocurrency wallet addresses linked to the group and urged industry partners to block transactions involving them. Binance separately pressed cryptocurrency issuers to freeze affected assets as the funds moved.
• Money still moving: Alec Zebrick, senior manager in global services at Chainalysis, told the BBC’s Today Programme that laundering is ongoing. “The attackers are layering these funds across many thousands of addresses, across thousands of deposits,” he said. Chainalysis is working with Binance and governments to recover the money.
• The entry point: Binance said early checks suggest the incident may have begun with a compromised laptop belonging to an engineer, which allowed the attackers to find a route to making unauthorised transactions. The company has not said when the device was compromised.
• Scope of impact: The breach hit Binance.com, the global centralised exchange. The company’s US-facing platform said it was not affected. Binance was founded in China and reports hundreds of millions of registered users worldwide.
• Service restart: Withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed. Binance said further services will be restored in phases once security checks are completed, without naming which remain suspended.

Between the lines:

A net outflow of 2% of assets under management, after the largest hack on record, suggests customer flight was contained rather than systemic. That containment rests on Binance absorbing the loss itself — 95% already replaced from treasury and reserve funds — which converts a security failure into a balance-sheet cost the exchange says it can carry.

What’s next

Watch whether Binance closes the remaining 5% gap and which suspended services return in the next phases, and whether exchanges act on the FBI’s published wallet list as Chainalysis tracks the laundering.