Binance users withdraw $3.6bn after largest-ever crypto hack
The exchange froze transactions following the incident which has been linked to a North Korean group.
Key points
- Binance processed a net outflow of about $3.64 billion in withdrawals on November 1 after suspending transactions following a $6.3 billion crypto hack.
- The FBI has attributed the attack to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group.
- Binance says it has covered around 95% of the stolen assets and that withdrawals of more than two dozen major cryptocurrencies have resumed.
Binance users withdrew about $3.64 billion in net funds on November 1 after the crypto exchange suspended all transactions following the largest-ever crypto hack, which affected $6.3 billion worth of digital assets. The company said the incident hit its global centralised exchange, Binance.com, while its US-facing platform was not affected.
Binance said early checks suggest the attack may have begun with a compromised laptop belonging to an engineer, which let hackers find a way to make unauthorised transactions. The FBI has accused North Korea of responsibility and published a list of crypto wallet addresses linked to the attack, urging industry partners to block transactions involving them.
Withdrawal figures and recovery
Binance said it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 GMT on November 1, producing a net outflow of roughly $3.64 billion. The firm said there was an initial spike in withdrawals that later declined and was stabilising, and that the net figure was just over 2% of the $171 billion in assets under its management.
The company said withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, with further services to return in phases after security checks. Binance said it has covered around 95% of the stolen assets using its corporate treasury, futures insurance and emergency reserve funds, and that the remainder may take longer to source.
Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident.
— Binance
What the company said
Binance attributed the attack to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group, which stole a then-record $1.5 billion from crypto exchange Bybit in 2025. The exchange said it urged cryptocurrency issuers to freeze affected assets.
The firm stated: "Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident."
