Customers of Binance, the world’s largest cryptocurrency exchange, withdrew approximately $3.6bn in digital assets after the platform resumed transactions on Sunday, following a cyberattack that reportedly resulted in the theft of $6.3bn worth of cryptocurrencies.
The withdrawals followed Binance’s suspension of transactions in the aftermath of the attack, which has been attributed to North Korean cybercrime group TraderTraitor by several organisations, including the United States Federal Bureau of Investigation.
In a statement published on X, Binance said it processed $4.649bn in withdrawals and $1.01bn in deposits between 06:00 and 15:30 GMT on November 1, resulting in a net outflow of approximately $3.64bn.
“Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion,” the company said.
The exchange explained that withdrawals initially surged after transactions resumed but gradually declined as customers regained confidence in the platform.
It described the initial movement as an “initial spike” in withdrawals, which later declined and was “stabilising as expected”.
According to Binance, Sunday’s net withdrawals represented just over two per cent of the $171bn in assets under its management.
The company also said it had covered approximately 95 per cent of the assets stolen in the breach, although sourcing the remaining amount could take longer.
It reiterated its commitment to compensating for all losses resulting from the attack.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said.
Binance disclosed last week that it had set aside more than $6.3bn to address the consequences of the attack.
The exchange also announced that withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, had resumed, while other services would be restored in phases following security checks.
However, efforts to recover the stolen assets are continuing, with the funds still being moved across cryptocurrency networks.
Alec Zebrick, senior manager in global services at blockchain analysis firm Chainalysis, which is working with Binance and government agencies to recover the assets, told the BBC’s Today Programme that the stolen funds were still being actively laundered.
“We continue to see funds being laundered quite actively,” he said.
“The attackers are layering these funds across many thousands of addresses, across thousands of deposits,” he added.
The attack has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group, which was linked to the theft of $1.5bn from cryptocurrency exchange Bybit in 2025.
On Saturday, the FBI published a list of cryptocurrency wallet addresses linked to the group and urged industry partners to help identify and block transactions involving the addresses.
Binance subsequently called on cryptocurrency issuers to freeze assets associated with the attack.
The exchange said preliminary investigations indicated that the breach might have originated from an engineer’s compromised laptop, which allegedly provided hackers with an opportunity to execute unauthorised transactions.
The incident affected Binance’s global centralised exchange, Binance.com, while its United States-facing platform was reportedly unaffected.
Binance said it had replaced customers’ assets using a combination of its corporate treasury, futures insurance and emergency reserve funds.
How the Binance cyberattack unfolded
Founded in China, Binance has hundreds of millions of registered users worldwide and remains the world’s largest cryptocurrency exchange by trading volume.
According to findings by The Telegraph, the October 29, 2026, attack is believed to be the largest cryptocurrency theft on record, surpassing the $1.5bn stolen from Bybit in 2025.
Reuters, in a report published on October 30, said hackers stole approximately $6.3bn from Binance’s transaction-processing wallets, with most of the theft occurring within 20 minutes.
The BBC, in a report published on October 30 and updated on November 2, said Binance initially suspected that a compromised laptop belonging to an engineer was responsible for the breach but later identified additional possible points of compromise.
The Associated Press, reporting on October 30, cited blockchain intelligence firms that linked the attack to North Korea’s TraderTraitor group.
The FBI confirmed the attribution on October 31, identifying the same group as responsible for the Bybit attack, according to Reuters.
