Binance customers withdrew $3.64bn (£2.72bn) of assets from the world's largest cryptocurrency exchange when it reopened on Sunday, following a record hack last week, according to Binance. The exchange said net withdrawals were about 2% of the $171bn of assets it manages.
Binance suspended all transactions after the incident, which affected $6.3bn worth of digital assets. The company said it had covered around 95% of the stolen assets. It said the remaining amount may take longer to source.
Binance posted on X that between 06:00 and 15:30 GMT on November 1, it processed $4.649bn in withdrawals and $1.01bn in deposits. It said there was an "initial spike" in withdrawals, which later declined and are "stabilising as expected."
The exchange said it had reserved more than $6.34bn to deal with the fallout. It said withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed. Other services will resume in phases once security checks are complete.
The FBI has accused North Korea of responsibility for the attack. The FBI published a list of cryptocurrency wallet addresses linked to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. The FBI urged industry partners to block transactions involving those addresses. The attack has been attributed to the group, which stole a then-record $1.5bn from crypto exchange Bybit in 2025.
Binance said early checks suggest the incident may have started with a compromised laptop belonging to an engineer. The hack affected Binance.com, while the company said its US-facing platform was not affected. Binance said it has used corporate treasury funds, futures insurance and emergency reserve funds to replace customers' assets. The company said it "will fully cover the financial impact of the funds stolen in this incident."