On a Sunday in early November, the world's largest cryptocurrency exchange, Binance, came back to life after a breach that stands as the largest theft in the history of digital money. Customers, uneasy after the shock, withdrew a net sum of roughly $3.6 billion in a single day, a reminder that trust in a financial institution is rebuilt slowly, even when its losses are being made good. Officials point to North Korean state-linked hackers, a group that has already struck once before at the scale of a record, and the episode shows how the fragility of digital systems can ripple far beyond any si
Binance Users Withdraw $3.6bn as Exchange Reopens After Record Hack Attributed to North Korea
A net outflow of about $3.64 billion in a single day
Mark
Start with the number. $3.64 billion left in a single day. How worried should anyone be?
Mimi
Binance frames it as contained. That is just over 2% of the $171bn it manages, and it says the initial spike faded and flows are stabilising.
Luke
Worth noting that's Binance's own account, posted on X. The window it covers is 06:00 to 15:30 GMT on one day. We don't have independent figures, and we don't know what the days after look like.
Mark
And the money that was stolen? Customers are being made whole?
Mimi
That's the promise. About 95% has been covered already, drawing on the corporate treasury, the futures insurance fund and the emergency reserve. The rest may take longer to source.
Luke
Again, 95% is the company's claim. And it says it will cover everything, but the remaining piece has no timeline attached.
Mark
Who is behind it?
Mimi
The FBI and other major organisations point to North Korea, specifically TraderTraitor, also called the Lazarus Group. That's the same group tied to the $1.5bn Bybit theft in 2025.
Luke
Attributed is the right word. The reporting says accused and attributed, not proven in public detail. The entry point, a compromised engineer's laptop, is also only what early checks suggest.
Mark
What is the practical next step?
Mimi
The FBI published wallet addresses linked to the group and asked industry partners to block transactions involving them. Binance is also asking issuers to freeze affected assets, while services come back in phases.
Luke
Whether any of that recovers funds is unanswered so far. The reporting doesn't say how much, if any, has been frozen.
O Pulso
- Customers pulled $4.6 billion out of Binance in a single day, leaving a net hole of about $3.6 billion as the exchange reopened.
- A $6.3 billion theft, blamed by the FBI on North Korea's TraderTraitor group, has rattled the entire crypto industry.
- Binance says it has already replaced about 95% of the stolen assets, drawing on treasury, insurance and emergency reserves.
- Withdrawals of major coins like Bitcoin and Ethereum have resumed, while other services return in phases after security checks.
- Industry partners are being asked to block FBI-listed wallet addresses, so the fallout may spread across exchanges beyond Binance.
On a Sunday in early November, the world's largest cryptocurrency exchange, Binance, came back to life after a breach that stands as the largest theft in the history of digital money. Customers, uneasy after the shock, withdrew a net sum of roughly $3.6 billion in a single day, a reminder that trust in a financial institution is rebuilt slowly, even when its losses are being made good. Officials point to North Korean state-linked hackers, a group that has already struck once before at the scale of a record, and the episode shows how the fragility of digital systems can ripple far beyond any single firm. What comes next depends on whether the outflows settle and whether the last sliver of stolen value is restored.
On Sunday, November 1, Binance customers pulled $4.649 billion out of the world's largest cryptocurrency exchange in just under ten hours. Deposits came in at $1.01 billion, leaving a net outflow of about $3.64 billion. The numbers, shared by the company on X, marked the first day of trading since a hack forced it to halt all transactions.
The attack touched $6.3 billion in digital assets, which makes it the largest hack on record. The FBI and other major organisations have pointed to North Korea, and specifically to a group known as TraderTraitor, also called the Lazarus Group. The same group had stolen a then-record $1.5 billion from the exchange Bybit in 2025.
Binance says the initial rush of withdrawals has already eased and that flows are stabilising. Net withdrawals amounted to just over 2% of the $171 billion in assets the firm manages. Withdrawals of more than two dozen major cryptocurrencies have resumed, and the remaining services will return in stages once security checks are complete.
The company has been firm about who bears the loss. It says about 95% of the stolen assets have been replaced, with the rest likely to take longer to source, and it has drawn on its corporate treasury, futures insurance fund and emergency reserves. "Binance will fully cover the financial impact of the funds stolen in this incident," it said.
Early findings suggest the breach may have begun with a compromised engineer's laptop. The attack struck the global Binance.com platform, while its US-facing service says it was untouched. The response has reached beyond the company: the FBI has published wallet addresses linked to the group and asked industry partners to block them, and Binance has urged token issuers to freeze the stolen assets.
The questions now are whether the outflows keep settling, how fast the final five percent is restored, and when the rest of the exchange's services can safely reopen.
Between 06:00 and 15:30 GMT on Sunday, November 1, Binance customers pulled $4.649 billion out of the world's largest cryptocurrency exchange. Deposits during the same window came to $1.01 billion, leaving a net outflow of about $3.64 billion (£2.72bn). The figures come from a post the company put on X, and they mark the first day of trading after a hack that forced it to suspend all transactions.
The attack affected $6.3bn worth of digital assets and is described as the largest hack in history. The FBI and other major organisations have accused North Korea of carrying it out. The attack has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. In 2025 the same group stole what was then a record $1.5bn from the exchange Bybit.
Binance said there was an initial spike in withdrawals that later declined, and that flows are stabilising as expected. It put Sunday's net withdrawals at just over 2% of the $171bn in assets it manages. It also said withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed. Other services will return in phases once security checks are finished.
On the question of who bears the loss, the company has been consistent. It says it has replaced about 95% of the stolen assets, and that the remainder may take longer to source. It drew on several pools: its corporate treasury, its futures insurance fund and its emergency reserve fund. Last week it said it had set aside more than $6.34bn to deal with the aftermath. "Binance will fully cover the financial impact of the funds stolen in this incident," the firm said.
How the breach began is still being established. Early checks, Binance said last week, suggest it may have started with a compromised laptop belonging to an engineer, which gave the attackers a way to make unauthorised transactions. The hack hit Binance.com, the global centralised exchange. Its US-facing platform has said it was not affected.
The response has also moved outside the company. On Saturday the FBI published a list of cryptocurrency wallet addresses linked to the group and asked partners in the industry to help by blocking transactions involving them. Binance, for its part, scrambled to urge cryptocurrency issuers to freeze the affected assets.
Binance was founded in China and has hundreds of millions of registered users around the world. What to watch next is whether the outflows keep stabilising, how quickly the remaining 5% of the stolen assets is replaced, and when the rest of the exchange's services come back after security checks.
Citações Notáveis
Binance will fully cover the financial impact of the funds stolen in this incident.— Binance statement
Quer a matéria completa?
Leia o original em BBC News ↗
Business