Binance Resumes Operations Following $6.3 Billion Hack as Customers Withdraw $3.6 Billion

Cryptocurrency exchange Binance processed $3.64 billion (£2.7 billion) in net customer withdrawals after reopening services on Sunday following a record $6.3 billion cyber attack.

The exchange suspended all transaction activity late last week after uncovering an unprecedented breach that impacted digital assets under its management. On Sunday, the firm launched a phased restoration of platform capabilities, allowing users to move funds across major networks including Bitcoin, Ethereum, and select stablecoins, as well as restoring U.S. dollar cash withdrawals on Monday.

During a nine-and-a-half-hour window following the reopening, Binance processed $4.649 billion in total withdrawals alongside $1.01 billion in incoming deposits. In an official update posted to social platform X, the company stated that activity levels were expected:

"Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion."

The net outflows represent roughly 2.1 percent of the $171 billion in total assets under management held by the company.

Addressing operations, Binance Co-CEO Yi He posted on X:

"Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations."

Federal authorities and independent cybersecurity researchers have officially attributed the intrusion to TraderTraitor, a state-sponsored North Korean cybercrime unit also known as the Lazarus Group.

On Saturday, the Federal Bureau of Investigation (FBI) released an official advisory detailing the findings:

“The Federal Bureau of Investigation is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6bn in virtual assets from cryptocurrency exchange Binance, on or about October 29.”

The agency warned that the perpetrators were converting stolen funds into Ethereum to launder through decentralized finance protocols and instant swap services, urging private sector partners “to block transactions with or derived from addresses TraderTraitor actors”.

Alec Zebrick, senior manager in global services at blockchain analytics firm Chainalysis, described the ongoing laundering efforts:

"We continue to see funds being laundered quite actively. The attackers are layering these funds across many thousands of addresses, across thousands of deposits."

To limit losses, asset issuers have frozen portions of the stolen funds, including over $1.1 billion in USDC frozen by Circle.

Binance leadership reiterated that customer accounts will not sustain financial losses as a result of the incident, confirming it has deployed over $6.3 billion in reserve funds to replenish stolen holdings.

The company sourced replacement assets through a combination of its corporate treasury, futures insurance funds, and its $1 billion Secure Asset Fund for Users (SAFU). By Sunday, the company had replaced approximately 90 percent of the stolen assets, noting that the remaining 10 percent comprised less liquid tokens that require additional time to acquire.

Binance Co-CEO Richard Teng confirmed the company's commitment:

"Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident."

Describing the technical nature of the exploit, Teng previously noted that the breach involved a “complex attack”. Initial investigations suggested the intrusion began with a compromised engineer's laptop containing malicious software designed to erase traces of its activity. The firm confirmed its U.S.-facing entity, Binance.US, was completely unaffected by the security breach.

The scale of the attack triggered temporary volatility across digital asset markets, with Bitcoin dropping to a six-week low near $76,000 before recovering above $78,000 over the weekend. Major institutional investment vehicles were also impacted, with spot Bitcoin ETFs recording $643 million in net daily outflows on Friday.

Market analysts cautioned that while immediate consumer panic was avoided, the heist could temper institutional adoption. Ari Redbord, global head of policy at TRM Labs, said:

"A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people's capital."

Former head of the UK National Crime Agency's international corruption unit and current iSanctuary CEO Jonathan Benton noted:

"The future of crypto won't be decided by how much money enters the market, but by how safe that money is once it's there."