Binance users withdraw $3.6bn after record crypto hack as services resume in phases
Binance said it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 GMT on 1 November, leaving a net outflow of about $3.64 billion after the exchange reopened. The company said the initial spike in withdrawals later eased and that flows were stabilising as expected. It added that withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, had resumed.
More from 360LiveNews Opinion
The exchange said the hack affected $6.3 billion worth of digital assets and that it had covered around 95% of the stolen funds, with the remainder likely to take longer to source. Binance said it had reserved more than $6.3 billion to deal with the fallout and repeated that it would cover all losses linked to the attack. It also said more services would return in phases once security checks were completed.
The incident remains significant because Binance is the world's biggest cryptocurrency exchange and the withdrawals represented just over 2% of the $171 billion in assets it said it held under management. The scale of the disruption has raised fresh questions about the resilience of large digital asset platforms, where a security breach can quickly trigger market stress and cross-border recovery efforts. The case also matters because the stolen funds are still being moved, according to a senior investigator at Chainalysis who said laundering activity continued across many thousands of addresses.
Authorities have linked the attack to North Korea, with the US Federal Bureau of Investigation publishing wallet addresses it said were associated with the group it blames. Binance has also been working with cryptocurrency issuers to freeze affected assets, while investigators and governments try to trace the stolen money. The attack has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group, which has previously been linked to major thefts from crypto platforms.
More from 360LiveNews Opinion
Binance said early checks suggested the incident may have started with a compromised laptop belonging to an engineer, allowing unauthorised transactions to be carried out. The company has not given a full timetable for restoring every function, but it said the recovery is being handled in stages. The exchange's US-facing platform said it was not affected, while the main global platform remained the focus of the response.
What remains unclear is how much of the remaining stolen value can still be recovered and whether further restrictions will be needed as services return. The next developments to watch are the pace of the phased reopening, any new findings on how the breach began, and whether investigators can slow the movement of the stolen funds. Binance has said withdrawals are stabilising, but the wider impact on confidence in crypto markets is still being assessed.
Binance customers withdrew more than $3.6bn in assets after the cryptocurrency exchange reopened on Sunday following a major hack last week. The incident affected $6.3bn worth of digital assets and prompted the firm to suspend all transactions while it worked to restore services. The exchange said withdrawals later began to stabilise after an initial surge.
The company said it has covered around 95% of the assets stolen in the breach, while the remaining amount may take longer to source. Binance has said repeatedly that it will cover all losses linked to the attack. It also said withdrawals for major cryptocurrencies such as Bitcoin and Ethereum have resumed, with more services to return in phases once security checks are completed.
More from 360LiveNews Opinion
The hack affected Binance's global centralised exchange, Binance.com, while its US-facing platform said it was not affected. Binance said early checks suggested the incident may have started with a compromised laptop belonging to an engineer, which allowed hackers to carry out unauthorised transactions. The company said the withdrawn crypto represented only a fraction of the total assets it holds in custody.
The scale of the breach matters because Binance is one of the largest cryptocurrency exchanges in the world and has hundreds of millions of registered users globally. The firm said in 2024 that it held more than $160bn in assets in custody, underlining the size of the platform and the potential market impact of any disruption. The incident also adds to wider concerns about the security of digital asset platforms, where losses can move quickly across borders and affect users in many countries.
Authorities have also pointed to possible state-linked involvement. The US Federal Bureau of Investigation has accused North Korea of being responsible for the cyber attack, which has been described as the largest hack in history. Binance was founded in China and has become a major global exchange, making the case significant not only for users but also for regulators and law enforcement tracking cross-border cybercrime.
What remains unclear is how long it will take to source the remaining stolen assets and whether any further service restrictions will be needed. Binance said withdrawals are stabilising, but it has not given a full timetable for the return of all functions. The key issues to watch are whether the exchange can complete its phased recovery without further disruption and whether investigators provide more detail on how the breach was carried out.
