Binance customers withdrew approximately $3.6 billion (£2.7bn) of assets from the world's biggest cryptocurrency exchange as it resumed operations on Sunday. This massive outflow occurred following a cyber-attack that is believed to be the largest in history, which initially forced the firm to suspend all transactions. The incident impacted digital assets valued at $6.3 billion.
Major organizations, including the US Federal Bureau of Investigation (FBI), have accused North Korea of orchestrating the cyber-attack. The breach has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. This same group was responsible for stealing a then-record $1.5 billion from the crypto exchange Bybit in 2025. In response, the FBI published a list of cryptocurrency wallet addresses linked to the group on Saturday and urged industry partners to block transactions involving them.
Binance stated that it has covered around 95% of the stolen assets, though sourcing the remaining amount may take longer. The exchange has repeatedly affirmed its commitment to covering all losses linked to the attack. According to a statement on X, between 06:00 and 15:30 GMT on November 1, the platform processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion. The firm noted an initial spike in withdrawals that later declined and is stabilizing as expected.
These Sunday withdrawals account for just over 2% of the $171 billion in assets under Binance's management. Last week, the firm announced it had reserved more than $6.3 billion to manage the fallout. Withdrawals for more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, with additional services expected to return in phases once security checks are completed.
Early investigations suggest the incident may have originated from a compromised laptop belonging to an engineer, which allowed hackers to execute unauthorized transactions. The attack targeted Binance's global centralized exchange, Binance.com, while its US-facing platform remained unaffected. To replace customer assets, Binance utilized a combination of sources, including its corporate treasury, futures insurance, and emergency reserve funds.
Despite these efforts, funds linked to the hack continue to be laundered. Alec Zebrick, senior manager in global services at Chainalysis, which is collaborating with the firm and governments to recover the stolen money, noted that attackers are actively layering funds across thousands of addresses and deposits. Binance was founded in China and currently serves hundreds of millions of registered users globally.
Sources: BBC News World.