Binance customers withdraw $3.6 billion after record hack
Binance customers pulled a net $3.64 billion as withdrawals reopened on 1 November, days after a $6.3 billion theft the FBI blames on North Korea.
Customers of Binance withdrew a net $3.64 billion as the exchange reopened on Sunday 1 November, following a record hack that affected $6.3 billion of digital assets. Binance said the outflow was about 2.1 per cent of its assets under management, that withdrawals stabilised after an initial spike, and that it has covered around 95 per cent of the stolen assets so far.
The $3.64 billion outflow
Customers of Binance withdrew a net $3.64 billion of assets as the world's largest cryptocurrency exchange reopened on Sunday 1 November, following a record hack last week. Binance said that between 06:00 and 15:30 GMT on 1 November it processed $4.649 billion in withdrawals and $1.01 billion in deposits, giving a net outflow of approximately $3.64 billion. The company said there was an initial spike in withdrawals, which later declined and stabilised as expected.
The outflow equalled about 2.1 per cent of the $171 billion in total assets Binance said it had under management as of 28 October. Analysts quoted in coverage described the withdrawals as a precautionary reaction rather than capital flight, though withdrawal levels are seen as an early test of whether customers still trust the exchange with their money after the attack.
How withdrawals resumed
Binance suspended all transactions after the attack, which affected $6.3 billion worth of digital assets on its global centralised exchange, Binance.com. Its US-facing platform has said it was not affected. Withdrawals resumed in phases from 06:00 GMT on 1 November, starting with 15 tokens including bitcoin and ether, and the company said withdrawals for more than two dozen major cryptocurrencies had resumed, with more services to follow in phases once security checks are completed.
Who is blamed
The US Federal Bureau of Investigation said on Saturday that the North Korean state-sponsored unit known as TraderTraitor, also known as the Lazarus Group, was responsible for the attack, and published wallet addresses linked to the group, urging industry partners to block transactions involving them. US President Donald Trump later said it remained unclear whether North Korea was involved, saying: 'We don't know if it's North Korea.' Pyongyang has for years denied using state-linked cyber units for financial theft. Early checks by Binance suggested the incident may have started with a compromised laptop belonging to an engineer.
What it means for customers
Binance has said it will fully cover the financial impact of the theft, and that it has covered around 95 per cent of the stolen assets so far, with the remaining, less liquid assets possibly taking longer to source. It said it has set aside around $6.34 billion of company funds, drawn from its corporate treasury, its futures insurance fund and its $1 billion Secure Asset Fund for Users, and that it would replenish the fund. One discrepancy remains: analytics platform DefiLlama put outflows higher, at $5.81 billion, but Binance said that figure excluded flows into its own new hot wallet and that its own update was closest to accurate. This article is general information only and not investment advice.
Editorial disclosure
This article was researched with AI assistance and reviewed by the publisher before publication. Report factual errors through our contact page.
Frequently asked questions
How much did Binance customers withdraw?
A net $3.64 billion between 06:00 and 15:30 GMT on 1 November, from $4.649 billion in withdrawals against $1.01 billion in deposits, according to Binance. That is about 2.1 per cent of its $171 billion in assets under management.
Has Binance covered the stolen funds?
Binance says it has covered around 95 per cent of the stolen assets so far and will fully cover the financial impact, with about $6.34 billion of company funds set aside. The remaining, less liquid assets may take longer to source.
Who does the FBI blame for the hack?
The FBI blames TraderTraitor, a North Korean state-sponsored unit also known as the Lazarus Group. President Donald Trump later said it remained unclear whether North Korea was involved.