Customers of Binance withdrew a net $3.64bn in cryptocurrency assets on Sunday after the exchange restored withdrawal services following a major cyberattack that resulted in the theft of about $6.3bn.
The withdrawals followed a temporary suspension of transactions as the world’s largest cryptocurrency trading platform responded to the breach, which the United States Federal Bureau of Investigation has linked to North Korean hackers.
In an update posted on X, Binance said it processed $4.649bn in withdrawals and received $1.01bn in deposits between 06:00 and 15:30 GMT on November 1, leaving a net outflow of approximately $3.64bn.
The company said withdrawals initially surged when services resumed but later slowed, with activity beginning to stabilize.
Binance noted that the net outflow represented slightly more than two per cent of the $171bn in assets under its management.
The exchange also said it had replaced about 95 per cent of the assets stolen during the attack, although recovering the remaining amount could take more time. It maintained that it would cover the full financial impact of the incident.
The company had earlier disclosed that it set aside more than $6.3bn to manage the consequences of the breach.
Withdrawal services for more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have since been restored. Binance said other affected services would return gradually after completing security checks.
However, efforts to recover the stolen assets remain ongoing. Alec Zebrick, senior manager of global services at blockchain analytics firm Chainalysis, which is working with Binance and government agencies, said the attackers were still actively moving the funds through cryptocurrency networks.
He told the BBC that the stolen assets were being distributed across thousands of digital wallet addresses and deposit points in an effort to conceal their movement.
The attack has been linked to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. The group was previously blamed for stealing $1.5bn from cryptocurrency exchange Bybit in 2025.
On Saturday, the FBI released a list of cryptocurrency wallet addresses associated with the group and called on industry players to help prevent transactions involving the wallets. Binance also appealed to cryptocurrency issuers to freeze assets connected to the breach.
Preliminary investigations by Binance suggested that hackers may have gained access through an engineer’s compromised laptop, which allegedly provided an entry point for unauthorised transactions. The company later identified additional possible points of compromise, according to reports.
The attack affected Binance’s global centralised trading platform, Binance.com, while its US-facing platform said it was not impacted.
Binance said it had restored customers’ assets using funds from its corporate treasury, futures insurance arrangements and emergency reserves.
How the Binance hack unfolded
The October 29, 2026 attack is believed to be the largest cryptocurrency theft on record, exceeding the $1.5bn stolen from Bybit in 2025.
Reuters reported on October 30 that hackers took about $6.3bn from Binance’s transaction-processing wallets, with most of the theft occurring within a 20-minute period.
A BBC report published on October 30 and updated on November 2 said Binance initially suspected that an engineer’s compromised laptop had played a role in the breach, but subsequent investigations pointed to additional entry points.
The Associated Press also reported that blockchain intelligence firms had connected the attack to North Korea’s TraderTraitor unit.
The FBI confirmed the group’s involvement on October 31, linking it to the Bybit theft and urging cryptocurrency companies to help disrupt its operations.
Founded in China, Binance has grown into the world’s largest cryptocurrency exchange by trading volume, with hundreds of millions of registered users worldwide.
