Within hours of Binance switching withdrawals back on, customers pulled a net $3.6bn off the exchange, the first clear read on confidence after a record cyber-attack that touched $6.3bn in digital assets.
The platform, the largest crypto exchange in the world, had frozen transactions after the breach and reopened them on Sunday. In the window between 06:00 and 15:30 GMT on 1st November, it logged $4.649bn going out and $1.01bn coming in, for net outflows of roughly $3.64bn. The rush was front-loaded, with withdrawals spiking early and then easing, settling into a pattern the company said it had anticipated.
Measured against the $171bn Binance held before the attack, those net outflows worked out at a little over 2%. The exchange said it had already restored around 95% of the stolen funds and warned that tracking down the last slice could take more time. It has said more than once that it will absorb every loss, pulling from its corporate treasury, its futures insurance fund and its emergency reserves to make customers whole.
More than two dozen major tokens, Bitcoin and Ethereum among them, are again available to withdraw. Remaining services are due back in stages as security checks clear.
Investigators say the stolen money has not gone quiet. Alex Zebrick, a senior investigator at blockchain analytics firm Chainalysis, that the thieves were still shifting the assets. “We continue to see funds being laundered quite actively,” he said, describing a laundering effort spread across many thousands of addresses and thousands of separate deposits.
The attack has been pinned on TraderTraitor, a North Korean cybercrime outfit also known as the Lazarus Group, the same crew tied to the $1.5bn theft from Bybit in 2025. On Saturday the FBI released crypto wallet addresses linked to the group and asked industry partners to block any transactions touching them. Binance, for its part, reached out to token issuers and pressed them to freeze the affected assets.
Early findings point to a compromised engineer’s laptop as the likely entry point, with attackers allegedly using the device to get in and push through unauthorised transactions. The damage was contained to the global exchange, Binance.com; the firm’s US-facing platform said it was untouched.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said. It has also promised to top up its emergency reserve in the wake of the breach.
