Binance, the world’s largest cryptocurrency exchange, reported $3.64 billion in net withdrawals on Sunday after resuming operations following a $6.3 billion security breach linked to North Korea. The exchange processed $4.65 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC on November 1, resulting in the net outflow. Withdrawals accounted for 2.1% of Binance’s $171 billion in total assets under management as of October 28, according to the company’s latest proof-of-reserves data.
Withdrawals stabilizing after initial spike
Binance stated that withdrawal volumes had declined and were stabilizing following an initial surge, while deposit volumes remained substantial. The exchange resumed withdrawals in phases on Sunday, prioritizing 15 cryptocurrencies, including Bitcoin, Ethereum, XRP, Dogecoin, and stablecoins such as USDT and USDC. Binance founder Changpeng Zhao noted that most net outflows occurred within the first two hours of resumed services, adding that 98% of users chose to remain on the platform.
Exchange covers 95% of stolen assets
Binance confirmed it had replaced approximately $6 billion of the stolen assets using company funds, covering 95% of the impacted amount. The remaining 5% consists of less liquid cryptocurrencies, which the exchange stated may take longer to source in the required quantities. The company reiterated its commitment to absorb all financial losses from the breach rather than passing them on to users.
Market reactions and broader context
Following the breach, Bitcoin prices recovered slightly to trade above $78,000, while Ethereum rose to $2,287, though both had previously hit multi-week lows. The combined market capitalization of the two largest stablecoins, USDT and USDC, dropped by $1.2 billion since Friday, according to CoinMarketCap. Spot Bitcoin ETFs experienced $643 million in outflows on Friday, the largest daily outflow in October, alongside $1.3 billion in liquidated leveraged positions, as reported by blockchain analysis firm TRM Labs.
FBI links North Korea to the attack
The U.S. Federal Bureau of Investigation (FBI) attributed the breach to hackers linked to North Korea, identifying the group as TraderTraitor. The FBI stated that the attackers were converting most of the stolen assets into Ethereum to obscure their tracks. This group was also responsible for a $1.5 billion attack on Bybit in February 2025, according to the FBI. The agency urged private-sector entities to block transactions involving addresses associated with TraderTraitor.
Recent trends in crypto thefts
The Binance breach adds to a series of high-profile cryptocurrency thefts in recent years. Researchers at TRM Labs reported that attackers stole $2.9 billion worth of cryptocurrency across nearly 150 incidents in 2024 alone. Withdrawal levels following such breaches serve as an early indicator of customer trust in exchanges. Analysts noted that the outflows from Binance were within the range of a precautionary reaction rather than a broader capital flight.
Exchange’s phased resumption of services
Binance emphasized a phased approach to restoring services, prioritizing tokens based on user demand over the past week. The company stated that testing continued for remaining networks and assets. Zhao underscored the importance of trust, stating that "Trust isn't earned by what you say in good times. It's earned by what you do in hard times."