Binance crypto withdrawals reached $4.65bn within hours of the exchange reopening on Sunday following a record $6.3bn cyber heist. The platform processed heavy transaction volumes after resuming operations in stages, recording a net customer outflow of $3.64bn as users pulled assets before redemption rates began to stabilise.
Key points
- Binance processed $4.65bn in withdrawals and $1.01bn in deposits on Sunday, resulting in a net asset outflow of $3.64bn.
- The firm said it has covered 95% of stolen assets using its corporate treasury, insurance reserves and emergency fund.
- United States investigators blamed North Korea’s TraderTraitor cyber syndicate for the $6.3bn breach, which took 20 minutes to execute.
- Exchange management confirmed the initial surge in withdrawals has subsided, with total outflows representing just over 2% of platform assets.
How the outflows unfolded
Customer redemptions surged early on Sunday, 1 November, after Binance opened access following a mandatory 48-hour trading halt. Between 06:00 and 15:30 GMT, users initiated $4.649bn in withdrawals, while processing $1.01bn in fresh customer deposits during the same window.
The resulting net outflow of $3.64bn represents approximately 2.1% of the $171bn in total assets Binance held under custody as of 28 October. The exchange reported that transaction queues experienced an initial surge when services returned, but volumes dropped steadily across the afternoon.
Third-party tracking services reported conflicting metrics during the reopening window. Analytics dashboard DefiLlama initially pegged platform outflows at $4.36bn before raising its calculation to $5.81bn later in the day.
Binance disputed the third-party figures. A company spokesperson said the DefiLlama metric failed to account for assets moving directly into internal operational reserves, explaining that public exchange statements on X provided the accurate accounting of customer movements.
Covering the $6.3bn loss
The operational shutdown followed a swift digital intrusion late on Thursday, 29 October, when intruders drained $6.3bn in digital tokens within 20 minutes. Internal investigations indicated the breach may have originated from a compromised laptop assigned to an engineer, granting intruders access to authorise outbound transactions.
The incident targeted Binance.com, the primary centralised platform catering to international traders. The operator confirmed its separately managed affiliate, Binance.US, remained unaffected by the exploit.
Binance moved quickly to shield client balances from the shortfall. The firm set aside more than $6.34bn from corporate reserves to replace customer funds, purchasing replacement tokens directly on the open market.
Company executives said the exchange had replaced $6bn worth of lost cryptocurrencies by Sunday, representing roughly 95% of the total amount taken. The remaining 5% involves less liquid tokens that require additional time to purchase without disrupting spot market prices.
Funding for the recovery came from three separate corporate pools. Binance tapped its corporate treasury balance, drew from its Futures Insurance Fund, and utilised 50% of its Secure Asset Fund for Users, a dedicated Bitcoin safety buffer. Co-chief executive Yi He pledged that Binance would replenish the reserve back to its baseline $1bn valuation.
Investigation points to North Korea
The scale of the breach prompted swift involvement from international law enforcement and intelligence agencies. In a formal public alert issued by the FBI, American federal investigators attributed the theft to TraderTraitor, an elite state-sponsored cyber unit operated by North Korea.
Also tracked under the Lazarus Group designation, the squad previously took $1.5bn from cryptocurrency platform Bybit during a 2025 cyberattack. Blockchain monitoring confirmed that members of the syndicate began shifting the stolen Binance reserves into Ether within minutes of draining the wallets.
Blockchain tracking groups TRM Labs and Chainalysis reported that the operational pattern matched previous North Korean state intrusions. The FBI released a detailed register of target cryptocurrency wallet addresses, directing exchange security desks and digital token issuers to freeze associated transactions.
Pyongyang has repeatedly dismissed international claims that it maintains state-run hacking squads for financial theft. Diplomatic missions representing North Korea in Geneva and Beijing did not issue statements regarding the federal findings.
Political leaders offered varying assessments of the findings over the weekend. Speaking to reporters on Saturday, US President Donald Trump appeared cautious regarding direct attribution, stating: “We don’t know if it’s North Korea – but if it is, we’ll talk to North Korea about it.”
Market impact and phased recovery
The record loss rattled broader digital asset trading desks through the end of the week. Bitcoin sank to a six-week low near $78,000 on Friday before steadying over the weekend, while Ether dropped to a two-month low of $2,287 before recovering slightly on Monday morning.
Capital flight also showed up across dollar-pegged tokens. The joint market capitalisations of Tether and USD Coin contracted by approximately $1.2bn between Friday and Monday, indicating that a portion of digital asset holders exited trading positions into fiat bank accounts entirely.
External analysts argued that the initial outflow figures did not indicate a structural collapse of platform confidence. Ari Redbord, global head of policy at TRM Labs, said the redemptions fell “in the range of a precautionary reaction rather than any sort of capital flight.”
To manage network load and security protocols, Binance announced that crypto withdrawals resumed in phases rather than all at once. The first phase covered 15 widely held tokens, prioritising Bitcoin, Ether, Dogecoin, Tether and USD Coin.
Technical teams are conducting system checks across secondary token networks before opening access to the remainder of the exchange’s trading pairs. The platform serves roughly 335 million registered accounts across global markets.
Management also warned account holders about secondary threats emerging in the aftermath of the $6.3bn crypto heist. Yi He cautioned that third-party fraud rings had launched spoofed customer support portals and social media phishing campaigns to target users seeking reassurance regarding their balances.
Security specialists at Binance continue to review internal access protocols and audit remaining token bridges as normal withdrawals expand across the platform this week.
