Customers of Binance, the world’s largest cryptocurrency exchange, withdrew approximately $3.6bn in assets after the platform resumed transactions on Sunday following a cyberattack involving $6.3bn worth of digital assets.
The withdrawals came after Binance suspended all transactions following the incident, which has been attributed to North Korea by major organisations, including the United States Federal Bureau of Investigation.
In a statement published on X, Binance said it processed $4.649bn in withdrawals and $1.01bn in deposits between 06:00 and 15:30 GMT on November 1, resulting in a net outflow of approximately $3.64bn.
“Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion,” the company said.
The exchange said there was an initial surge in withdrawals, which subsequently declined.
There was an “initial spike” in withdrawals, which later declined and “are stabilising as expected”, it added.
According to Binance, Sunday’s net withdrawals represented just over two per cent of the $171bn in assets under its management.
The company said it had covered about 95 per cent of the assets stolen in the breach, adding that sourcing the remaining amount could take longer. It also reiterated its commitment to covering all losses linked to the attack.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the firm said.
Binance disclosed last week that it had reserved more than $6.3bn to address the consequences of the attack.
The exchange also announced that withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, had resumed, while other services would return in phases after security checks.
However, funds stolen in the attack are still being moved through cryptocurrency networks, according to Alec Zebrick, senior manager in global services at blockchain analysis firm Chainalysis, which is working with Binance and governments to recover the assets.
“We continue to see funds being laundered quite actively,” he told the BBC’s Today Programme.
“The attackers are layering these funds across many thousands of addresses, across thousands of deposits,” he added.
The attack has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group, which stole a then-record $1.5bn from cryptocurrency exchange Bybit in 2025.
On Saturday, the FBI published a list of cryptocurrency wallet addresses linked to the group and urged industry partners to help block transactions involving them.
Binance subsequently urged cryptocurrency issuers to freeze affected assets.
The exchange said preliminary investigations suggested that the incident might have originated from a compromised laptop belonging to an engineer, which allegedly enabled hackers to find a way to carry out unauthorised transactions.
The attack affected Binance’s global centralised exchange, Binance.com, while its United States-facing platform said it was not affected.
Binance said it had replaced customers’ assets using a combination of its corporate treasury, futures insurance and emergency reserve funds.
Founded in China, Binance has hundreds of millions of registered users worldwide.
The October 29, 2026, attack is believed to be the largest cryptocurrency theft on record, surpassing the $1.5bn stolen from Bybit in 2025.
Reuters, reporting on October 30, said hackers stole about $6.3bn from Binance’s transaction-processing wallets, with most of the theft occurring within 20 minutes.
Also, the BBC, in a report published October 30 and updated November 2, said Binance initially suspected an engineer’s compromised laptop but later identified additional breach points.
The Associated Press, reporting on October 30, cited blockchain intelligence firms linking the attack to North Korea’s TraderTraitor unit.
The FBI confirmed the attribution on October 31, saying the same group was behind the Bybit attack, said Reuters.
