Binance users withdraw $3.6bn as exchange reopens after record crypto hack

Binance customers pulled $3.6bn in net withdrawals on Sunday as the exchange began a phased reopening after the largest cryptocurrency hack in history.

The breach occurred on Thursday. It impacted $6.3bn worth of digital assets and has been described as the biggest heist on record. Major organisations including the FBI have accused North Korea of responsibility, with the attack attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. Binance, founded in China and with hundreds of millions of registered users globally, initially froze all withdrawals as it investigated the breach, then on Sunday announced a phased reopening.

Between 06:00 and 15:30 GMT on November 1, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits, the exchange said on X. There was an “initial spike” in withdrawals, which later declined and are stabilising as expected, it added. The resulting net outflow accounted for 2.1% of the $171bn in assets under Binance’s management. Withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, with additional services set to follow in phases once security checks are completed.

Binance moves to backstop losses

Binance said it has covered around 95% of the assets stolen in the breach, but the remaining amount may take longer to source. Last week, the exchange said it had reserved more than $6.3bn in funds to deal with the fallout of the attack, drawing on a combination of its corporate treasury, futures insurance, and emergency reserve funds. “Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the firm said.

The hack hit Binance.com, the global centralised exchange. The US-facing platform was not affected. Early checks suggest the incident started with a compromised laptop belonging to an engineer, allowing hackers to make unauthorised transactions.

FBI links attack to North Korean group

The FBI on Saturday published a list of cryptocurrency wallet addresses linked to the group and urged industry partners to block transactions involving them. The exchange scrambled to urge cryptocurrency issuers to freeze affected assets. The Lazarus Group stole a then-record $1.5bn from crypto exchange Bybit in 2025. Funds linked to the Binance hack continue to be laundered, according to Chainalysis, which has been working with Binance and governments to recover the stolen money. “We continue to see funds being laundered quite actively,” Alec Zebrick, senior manager in global services at Chainalysis, told the BBC’s Today Programme. “The attackers are layering these funds across many thousands of addresses, across thousands of deposits,” he added.

Ripples across crypto markets

US spot Bitcoin ETFs recorded $643 million in net outflows on Friday, their first trading session after the hack, according to Nick Forster, chief executive of Derive.xyz, a crypto platform. No fund recorded net inflows. BlackRock’s IBIT saw $233.7 million in outflows, Fidelity’s FBTC lost $201 million, ARKB $129.5 million, GBTC $53.3 million, and BITB $25.7 million. Bitcoin settled at $77,786 on Friday, below the $80,000 level that Derive.xyz options markets had priced a 75% probability of before the hack. In the first 12 hours after the attack, put options accounted for 68% of Bitcoin options premiums traded on the platform, compared with 43% in the preceding five days. Approximately $55 million in daily Bitcoin options volume was recorded since the hack, compared with $34 million the day prior. Traders have been moving quickly to protect themselves against further losses, with downside protection taking a much larger share of options activity, Forster said. The odds of Bitcoin hitting $100,000 by end of year fell to 3.5% from 6% before the hack.

Changpeng Zhao, Binance’s founder, warned that scammers are targeting users trying to withdraw funds with fake screenshots and false information. “Some of you may have seen posts and screenshots circulating recently. Please be aware that these screenshots are fake and the information in them is false,” he wrote on X. The next phase of withdrawal resumption is planned as a progressive rollout.