Binance Users Pulled $3.64bn as Exchange Reopened After Record Hack

Binance customers withdrew a net $3.64bn (£2.72bn) from the world's largest cryptocurrency exchange on Sunday, the day the platform reopened after the largest hack in history. The breach affected $6.3bn worth of digital assets.

Binance suspended all transactions after the incident came to light. On November 1, in a window of roughly nine and a half hours, it processed the outflow that tested the exchange's defences and its balance sheet alike.

"Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion," Binance posted on X.

Who is behind the attack?

The FBI and other major organisations have accused North Korea of carrying out the cyber attack. The attribution points to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group — the same collective that stole a then-record $1.5bn from crypto exchange Bybit in 2025.

The FBI published a list of cryptocurrency wallet addresses linked to the group on Saturday. It urged industry partners to block any transactions involving those addresses.

The hack struck Binance's global centralised exchange, Binance.com. The company's US-facing platform said it has not been affected.

How did the hackers get in?

Binance said last week that early checks suggest the incident may have started with a compromised laptop belonging to an engineer. That foothold allowed hackers to find a way to make unauthorised transactions.

The exchange scrambled to urge cryptocurrency issuers to freeze affected assets — a race against the clock once the stolen funds began moving.

The entry point matters. A single engineer's device exposed a platform that, by Binance's own 2024 account, holds more than $160bn in custody. Binance has not said whether other endpoints were checked for the same weakness.

How much has Binance repaid?

The company said it has covered around 95% of the assets stolen in the breach. The remaining amount may take longer to source, it acknowledged.

Binance has reserved more than $6.34bn in funds to deal with the fallout, it said last week. It replaced customers' assets through a combination of channels: its corporate treasury, its futures insurance fund and emergency reserve funds.

"Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident," the firm said.

That is a promise, not yet a completed ledger. Roughly 5% of $6.3bn — more than $300m — remains unreturned, and Binance has given no timetable for the remainder.

Are withdrawals back to normal?

There was an "initial spike" in withdrawals, which later declined and "are stabilising as expected", Binance said. Withdrawals for more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed.

More services will come back in phases once security checks are completed. Binance has not published a schedule for those phases.

The $3.64bn pulled out on Sunday represents just a fraction of the total value of assets Binance holds. The firm is privately held, so its exact valuation is unclear. The comparison is worth framing plainly: customers removed roughly one dollar for every forty-four dollars the exchange said it held in custody as of 2024.

What is the so-what?

Binance was founded in China and has hundreds of millions of registered users globally. Cryptocurrencies — digital assets that exist only on computers and smartphones, not in physical form — trade on exchanges such as Binance precisely because users trust the operator to hold them. That trust is the product.

The exchange has absorbed the financial hit and reopened its doors within days. Whether Lazarus-linked wallets stay frozen, and how quickly the last several hundred million dollars in stolen assets are replaced, will determine whether this recovery holds. The FBI's wallet blacklist, and the industry's willingness to enforce it, is now the operative line of defence.