Customers withdrew a net $3.64 billion from Binance on Sunday as the world’s largest cryptocurrency exchange resumed transactions following a record cyberattack that affected $6.3 billion in digital assets.
The withdrawals came after Binance temporarily suspended transactions in the wake of the breach, which has been attributed by US authorities to North Korea-linked hackers. The exchange says it has covered about 95% of the stolen assets and remains committed to compensating customers for the full financial impact.
Binance reported that it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 GMT on November 1, resulting in a net outflow of approximately $3.64 billion.
“Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion,” the company said in a post on X.
The exchange said withdrawals initially surged after services resumed but subsequently eased.
There was an “initial spike” in withdrawals, which later declined and “are stabilising as expected”, Binance said.
The company added that Sunday’s net outflow represented just over 2% of the $171 billion in assets under its management, seeking to put the scale of customer withdrawals in perspective.
Binance restores withdrawals as it mobilises funds to cover losses
Binance said withdrawals involving more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, had resumed. Other services are expected to return in stages after security checks are completed.
The company said it had already replaced customer assets using several funding sources, including its corporate treasury, futures insurance and emergency reserve funds.
Binance had previously said it reserved more than $6.34 billion to manage the consequences of the breach. However, it acknowledged that sourcing the remaining amount could take longer.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said.
The breach affected Binance’s global centralised exchange, Binance.com. Its US-facing platform said it was not affected.
Binance’s initial investigation suggested that the attack may have originated from a compromised laptop belonging to an engineer. Hackers allegedly exploited the access to identify a route for carrying out unauthorised transactions.
The company has not publicly disclosed all the technical details of the breach.
FBI links attack to North Korean hackers
US authorities have attributed the attack to TraderTraitor, a North Korean cybercrime operation also known as the Lazarus Group.
The group has previously been linked to major cryptocurrency thefts, including the 2025 attack on exchange Bybit, in which hackers stole $1.5 billion worth of digital assets.
The FBI published a list of cryptocurrency wallet addresses linked to the group on Saturday and urged cryptocurrency businesses and other industry participants to block transactions involving those addresses.
Binance also moved to contact cryptocurrency issuers, urging them to freeze assets connected to the breach in an effort to prevent the stolen funds from being transferred or converted.
The incident adds to mounting security concerns surrounding cryptocurrency exchanges, where large volumes of digital assets are held and traded through interconnected computer systems.
Binance, founded in China, has hundreds of millions of registered users worldwide and is the largest cryptocurrency exchange by trading activity. The scale of Sunday’s withdrawals makes the market’s response an important test of customer confidence as the company works to restore services and account for the stolen funds.