Customers of Binance have withdrawn about $3.6bn following a major cyberattack on the cryptocurrency exchange.
The withdrawals began after the platform resumed services on Sunday. Hackers reportedly stole $6.3bn worth of digital assets during the October 29 attack.
Binance had suspended transactions following the incident. The breach has been linked to North Korea by major organisations, including the United States Federal Bureau of Investigation (FBI).
Binance Records $3.64bn Net Outflow
Binance disclosed the withdrawal figures in a statement shared on X.
The company processed $4.649bn in withdrawals between 6am and 3:30pm GMT on November 1. It also received $1.01bn in deposits during the same period.
This resulted in a net outflow of approximately $3.64bn.
The exchange said withdrawals initially surged after services resumed. However, the volume later declined.
Binance described the situation as expected. It also said withdrawal activity was gradually stabilising.
According to the company, the net outflow represented just over two per cent of its $171bn assets under management.
Binance Promises to Cover Stolen Funds
The cryptocurrency exchange said it had covered about 95 per cent of the stolen assets.
However, sourcing the remaining amount could take longer. Binance explained that obtaining the outstanding assets would require additional time.
The company also reaffirmed its commitment to covering all losses from the attack.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said.
Binance had earlier disclosed that it reserved more than $6.3bn to address the incident.
The exchange said it would use its corporate treasury and emergency reserves. Its futures insurance fund would also help replace affected assets.
Withdrawals Resume in Phases
Binance has restored withdrawals for more than two dozen major cryptocurrencies.
These include Bitcoin and Ethereum. However, other services are returning gradually after additional security checks.
The exchange said its phased approach would help protect users. It also warned customers about possible processing delays.
Meanwhile, blockchain investigators are tracking the stolen funds.
Alec Zebrick, senior manager in global services at Chainalysis, confirmed that the stolen assets were still moving across cryptocurrency networks.
His firm is working with Binance and government agencies to recover the funds.
“We continue to see funds being laundered quite actively,” he told the BBC’s Today Programme.
He added that attackers were spreading the assets across thousands of wallet addresses and deposits.
FBI Links Attack to North Korean Hackers
The attack has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group.
The group was previously linked to the $1.5bn theft from cryptocurrency exchange Bybit in 2025.
On Saturday, the FBI published cryptocurrency wallet addresses linked to the group. It urged industry partners to block transactions involving those addresses.
Binance subsequently asked cryptocurrency issuers to freeze affected assets.
The exchange’s preliminary investigation pointed to a compromised laptop belonging to an engineer. Investigators believe the device may have allowed hackers to carry out unauthorised transactions.
However, the full circumstances surrounding the breach remain under investigation.
Binance Says US Platform Was Not Affected
The attack affected Binance’s global centralised exchange, Binance.com.
However, the company’s United States-facing platform said it was not affected.
Binance also confirmed that it had replaced customers’ stolen assets. The company used its treasury, futures insurance and emergency reserve funds.
The exchange is working with law enforcement and blockchain intelligence firms. It has also promised to publish a detailed report after completing its investigation.
$6.3bn Hack Becomes Largest Recorded Crypto Theft
The October 29 incident is believed to be the largest cryptocurrency theft on record.
It surpasses the $1.5bn stolen from Bybit in 2025.
Reuters reported that hackers stole approximately $6.3bn from Binance’s transaction-processing wallets. Most of the theft reportedly occurred within 20 minutes.
The BBC later reported that investigators had identified additional points of breach. This followed Binance’s initial suspicion of a compromised engineer’s laptop.
The Associated Press also cited blockchain intelligence firms linking the attack to North Korea’s TraderTraitor unit.
The FBI confirmed the group’s involvement on October 31.
Despite the resumption of withdrawals, the incident has renewed concerns about cryptocurrency exchange security. It has also raised questions about the protection of digital assets held on centralised platforms.
