Binance Customers withdrew approximately $3.64 billion (£2.72 billion) from Binance, the world’s largest cryptocurrency exchange, after it resumed operations on Sunday following a cyberattack that affected $6.3 billion worth of digital assets.
Binance had suspended transactions after the breach. The company said it had covered around 95% of the stolen assets and remained committed to compensating customers for the full amount.
Between 06:00 and 15:30 GMT on November 1, the exchange processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of $3.64 billion.
Binance said withdrawals initially surged before stabilising. The outflow represented just over 2% of its $171 billion in managed assets.
The attack has been attributed to TraderTraitor, also known as the Lazarus Group, a North Korean cybercrime group previously linked to the $1.5 billion Bybit hack in 2025.
The FBI published wallet addresses associated with the group and urged industry partners to block related transactions.
Binance said preliminary checks suggested a compromised laptop belonging to an engineer may have enabled unauthorised transactions. Its global platform was affected, while its US-facing exchange was not.
Binance said it had replaced stolen customer assets using its corporate treasury, futures insurance and emergency reserve funds.
Withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, with other services returning after security checks. The exchange also said it had reserved more than $6.3 billion to address the incident.
