Binance sees $3.6bn net outflow as trading resumes after record breach

Binance customers withdrew a net total of $3.6 billion, equivalent to £2.7 billion, from the world’s largest cryptocurrency exchange as it reopened on Sunday. This significant movement of funds occurred following what is widely believed to be the largest hack in history. The exchange had previously suspended all transactions in the wake of the incident, which impacted $6.3 billion worth of digital assets. Major organisations, including the US Federal Bureau of Investigation, have accused North Korea of being responsible for the cyber-attack.

The company stated that it has covered around 95% of the assets stolen in the breach, although the remaining amount may take longer to source. Binance has repeatedly affirmed its position that it would cover all losses linked to the attack. In a post on X, the firm detailed that between 06:00 and 15:30 GMT on 1 November, it processed $4.649 billion in withdrawals and $1.01 billion in deposits. This activity resulted in a net outflow of approximately $3.64 billion. The exchange noted that there was an initial spike in withdrawals, which later declined and are stabilising as expected. Sunday’s net withdrawals account for just over 2% of the $171 billion of assets under its management, according to Binance.

The firm said last week that it has reserved more than $6.3 billion in funds to deal with the fallout of the attack. Binance also confirmed that withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed. Further services will resume in phases once security checks are completed. Funds linked to the Binance hack continue to be laundered, according to Alec Zebrick, senior manager in global services at Chainalysis. The firm has been working with Binance and governments to recover the stolen money. Zebrick told the BBC’s Today Programme that they continue to see funds being laundered quite actively. He added that the attackers are layering these funds across many thousands of addresses, across thousands of deposits.

The attack on Binance has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. This group stole a then-record $1.5 billion from crypto exchange Bybit in 2025. The FBI published a list of cryptocurrency wallet addresses linked to the group on Saturday and urged partners in the industry to help by blocking transactions involving them. The exchange scrambled to urge cryptocurrency issuers to freeze affected assets. Binance said last week that early checks suggest the incident may have started with a compromised laptop that belonged to an engineer, allowing hackers to find a way to make unauthorised transactions.

The hack hit Binance’s global centralised exchange, Binance.com, while its US-facing platform has said it was not affected by the issue. Binance said it had replaced customers’ assets using a combination of sources, including its corporate treasury as well as its futures insurance and emergency reserve funds. The firm stated that its commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. Cryptocurrencies are digital assets traded on exchanges such as Binance. Unlike cash, they do not exist in physical form and are managed on computers, smartphones and other digital devices. Binance was founded in China and has hundreds of millions of registered users globally.