Binance users pulled $3.64 billion in net withdrawals after a record hack forced the exchange to freeze all transactions

Binance recorded $3.64 billion in net customer outflows on November 1 as the world’s largest cryptocurrency exchange reopened withdrawals following a record $6.3 billion hack that had forced it to suspend all transactions. The breach, described as the largest in history, tested the exchange’s repeated promise to make users whole and raised fresh questions about security across the cryptocurrency industry.

Withdrawals resumed in phases at 06:00 GMT on Sunday once security checks were completed, with services restored across all 15 networks and assets in the initial phase by 12:36 p.m. UTC and testing continuing for the remaining networks and assets. Between 06:00 and 15:30 GMT, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits, according to a post on X. The company reported an initial spike in withdrawal volumes that later declined and were stabilizing as expected, while deposit volumes remained substantial. Withdrawals of more than two dozen major cryptocurrencies like Bitcoin and Ethereum resumed, with additional services to follow in phases.

Binance says it will cover the full loss

Binance said it has covered approximately 95% of the impacted assets, up from 90% in its previous update. The remaining 5% consists of less liquid tokens that will take longer to source in the required quantities. To replace customers’ assets, the exchange drew on a combination of sources, including its corporate treasury, futures insurance, and emergency reserve funds. The firm said last week it had reserved more than $6.34 billion to deal with the fallout of the attack, a sum exceeding the total value of assets stolen. “Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said. Binance has repeatedly stated that it would not pass losses on to users.

FBI ties attack to North Korean hackers

The FBI attributed the attack to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. The same operation stole a then-record $1.5 billion from crypto exchange Bybit in 2025. On Saturday, the FBI published a list of cryptocurrency wallet addresses linked to the group and urged industry partners to block transactions involving them. The exchange scrambled to urge cryptocurrency issuers to freeze affected assets. Early checks suggest the incident started with a compromised laptop belonging to an engineer, which allowed hackers to make unauthorized transactions. The target was Binance.com, the global centralized exchange. Its US-facing platform was not affected.

The net outflows represented approximately 2.1% of Binance’s $171 billion in assets under management, based on the exchange’s latest proof-of-reserves data as of October 28. The figure indicates that the vast majority of assets remained on the platform. Changpeng Zhao, founder and former CEO, sought to reassure users. He said most net outflows occurred within the first couple of hours after withdrawals resumed. “98% choose to stay!” Zhao wrote on X. “Trust isn’t earned by what you say in good times. It’s earned by what you do in hard times,” he added. Binance was founded in China and has hundreds of millions of registered users globally.