Binance users pull $3.6bn after hack

Binance customers withdrew a net $3.64 billion from the exchange on Sunday, November 1, after the platform reopened following a record cyberattack. The outflow occurred during a ten-and-a-half-hour window when the firm processed $4.649 billion in withdrawals against $1.01 billion in deposits. Binance stated that withdrawals for over two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed. The company noted that other services will return in phases once security checks are complete.

The hack, attributed to the North Korean group TraderTraitor, also known as the Lazarus Group, affected $6.3 billion worth of digital assets. The FBI accused the group of responsibility on Saturday and published a list of linked cryptocurrency wallet addresses. The agency urged industry partners to block transactions involving those addresses. TraderTraitor previously stole a then-record $1.5 billion from the exchange Bybit in 2025.

Binance suspended all transactions immediately after the incident was detected. The firm later revealed that early checks suggest the breach began with a compromised laptop belonging to an engineer. Hackers used the access to execute unauthorized transactions on Binance.com, the platform's global centralized exchange. The US-facing platform of the exchange has stated it was not affected by the issue.

The exchange has reserved more than $6.34 billion in funds to address the fallout. Binance said it has covered approximately 95% of the stolen assets using its corporate treasury, futures insurance, and emergency reserve funds. The remaining amount may take longer to source, but the firm reiterated its commitment to fully cover the financial impact of the theft. The company is privately held and reported more than $160 billion in assets in custody in 2024.

The net withdrawal amount represents a small fraction of the total value of assets held by the exchange. Binance was founded in China and reports having hundreds of millions of registered users globally. The firm has repeatedly stated it would cover all losses linked to the attack. The initial spike in withdrawals later declined, with the company saying outflows are stabilizing as expected.

The FBI's Saturday announcement included specific wallet addresses linked to the cybercrime group. The agency called on partners to help block transactions involving these addresses. Binance had scrambled to urge cryptocurrency issuers to freeze affected assets during the initial response. The incident is described as the largest hack in history due to the scale of the assets impacted.

Binance's statement on X detailed the specific times of the financial activity on November 1. The firm processed the majority of the net outflow between 06:00 and 15:30 GMT. The company replaced customers' assets through various internal channels. The exact valuation of Binance remains unclear, though the firm maintains it has the reserves to handle the incident's costs.