Binance users withdraw $3.6bn after record cryptocurrency hack

Customers of Binance, the world’s largest cryptocurrency exchange, withdrew approximately $3.6bn in digital assets after the platform resumed operations on Sunday following a cyberattack that affected $6.3bn worth of cryptocurrencies.

The withdrawals came after Binance suspended transactions in response to the breach, which has been blamed on North Korea by major organisations, including the US Federal Bureau of Investigation (FBI).

Binance disclosed that it processed $4.649bn in withdrawals and $1.01bn in deposits between 06:00 and 15:30 GMT on November 1, leaving the exchange with a net outflow of approximately $3.64bn.

The company announced the figures on X, saying: “Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion.”

According to the exchange, withdrawals initially surged following the resumption of services but subsequently slowed, with activity “stabilising as expected”.

Despite the significant outflow, Binance said the withdrawals represented just over two per cent of the $171bn in assets under its management.

The company has also assured customers that it is working to recover from the breach, maintaining that it will bear the full financial consequences of the incident.

Binance said it had already replaced approximately 95 per cent of the stolen assets, although recovering the outstanding amount could take additional time. It added that the replacement funds came from its corporate treasury, futures insurance and emergency reserve funds.

“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the firm said.

Last week, the exchange disclosed that it had set aside more than $6.3bn to manage the consequences of the attack.

It also confirmed that withdrawals involving more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, had resumed. Other services are expected to return in stages after completing the necessary security checks.

However, efforts to trace and recover the stolen funds are being complicated by continued laundering activities.

Alec Zebrick, senior manager in global services at blockchain analysis firm Chainalysis, which is assisting Binance and government agencies with the recovery effort, said the attackers were actively moving the stolen assets through multiple cryptocurrency wallets.

“We continue to see funds being laundered quite actively,” he told the BBC’s Today Programme.

“The attackers are layering these funds across many thousands of addresses, across thousands of deposits,” he added.

The attack has been linked to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. The group was previously linked to the theft of $1.5bn from cryptocurrency exchange Bybit in 2025, then considered a record-breaking cryptocurrency heist.

On Saturday, the FBI released a list of cryptocurrency wallet addresses associated with the group, asking industry partners to help prevent the movement of stolen funds by blocking transactions connected to the addresses.

ALSO READ: US: All nine on board killed as jet crashes near Trump’s Florida home

Binance also called on cryptocurrency issuers to freeze assets believed to be linked to the breach.

The exchange’s preliminary investigation indicated that the attack may have originated from an engineer’s compromised laptop, which hackers allegedly exploited to gain access to unauthorised transactions.

The incident affected Binance.com, the company’s global centralised exchange. However, Binance’s US-facing platform said it was not impacted.

Binance was founded in China and has hundreds of millions of registered users worldwide. The platform allows customers to buy, sell and trade cryptocurrencies, which are digital assets that exist electronically rather than in physical form.