Binance users withdraw $3.6bn after largest-ever crypto hack
Customers of Binance, the world's biggest cryptocurrency exchange, withdrew $3.6bn of assets as it reopened on Sunday following what is believed to be the largest hack in history. The firm said that between 06:00 and 15:30 GMT on November 1 it processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion.
The incident impacted $6.3bn worth of digital assets, and Binance suspended all transactions in its wake.
Major organisations, including the US Federal Bureau of Investigation (FBI), have accused North Korea of being responsible for the cyber-attack. The attack has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group, which stole a then-record $1.5bn from crypto exchange Bybit in 2025.
On Saturday the FBI published a list of cryptocurrency wallet addresses linked to the group and urged partners in the industry to help by blocking transactions involving them. Binance also scrambled to urge cryptocurrency issuers to freeze affected assets.
Binance said it has covered around 95% of the assets stolen in the breach, but the remaining amount may take longer to source. The firm has repeatedly said it would cover all of the losses linked to the attack, and last week it said it had reserved more than $6.3bn in funds to deal with the fallout.
The exchange said it replaced customers' assets using a combination of sources, including its corporate treasury as well as its futures insurance and emergency reserve funds. "Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident," the firm said.
Sunday's net withdrawals account for just over 2% of the $171bn of assets under Binance's management. The firm said there was an "initial spike" in withdrawals, which later declined and "are stabilising as expected".
Withdrawals of more than two dozen major cryptocurrencies like Bitcoin and Ethereum have resumed, and more services will resume in phases once security checks are completed, Binance said.
Early checks suggest the incident may have started with a compromised laptop that belonged to an engineer, allowing hackers to find a way to make unauthorised transactions. The hack hit Binance's global centralised exchange, Binance.com, while its US-facing platform has said it was not affected by the issue.
Binance was founded in China and has hundreds of millions of registered users globally. Cryptocurrencies are digital assets traded on exchanges such as Binance; unlike cash, they do not exist in physical form and are managed on computers, smartphones and other digital devices.
