NEW YORK, United States / CryptoWire.AI / – Binance customers withdrew more than $4.6 billion after the exchange reopened withdrawals following what security experts called the largest crypto theft on record. The exchange said users also deposited just over $1 billion after transactions resumed on Sunday, November 1. That left a net outflow of $3.64 billion. Binance said the figure equals about 2.1% of its roughly $171 billion in total assets.
Binance said it processed about $4.65 billion in withdrawals and $1.01 billion in deposits between 6 a.m. and 3:30 p.m. UTC on Sunday. Withdrawals for Bitcoin, Ethereum and other cryptocurrencies returned in phases. The exchange later restored withdrawals on more networks, including Zcash, TON and Sui. It also resumed fiat withdrawals in U.S. dollars on Monday, according to media reports. Binance is the world’s largest crypto exchange, with more than 300 million users.
Binance co-founder Yi He said in a post on X early Monday that the priority was to make sure the environment was secure. Users could then withdraw their funds and the exchange could resume full operations, she said. Yi He also said not all of the outflow represented customer withdrawals. Some of the transactions were transfers between the exchange’s own wallets, she added. Most of the outflow came in the first hours after withdrawals reopened, according to reports.
FBI ties attack to North Korean hackers
The FBI said on Saturday that a North Korean hacking group known as TraderTraitor was behind the theft of $6.3 billion in digital assets from Binance. The bureau said the group was converting most of the stolen funds into Ethereum to hide its tracks. Further laundering is likely, the FBI said. TraderTraitor was also responsible for the February 2025 attack on Bybit, which cost that exchange $1.5 billion.
The FBI urged private-sector firms to block transactions with, or derived from, addresses the group is using to launder the stolen assets. About $3 billion of the stolen crypto has been frozen so far, according to Binance. Freezing allows certain token issuers to block transfers of their tokens anywhere in the world. Tether and Circle together froze more than $1.8 billion in stablecoins after the breach.
Exchange says it covered most losses
Binance has promised to cover the full losses with company funds. By early Sunday, it said it had covered around 95% of the impacted amount. The exchange said customer balances are safe. Its initial investigation found that an attacker used a compromised laptop belonging to a DevOps engineer to submit unauthorised withdrawals. That gave the attacker access to a service container. Binance said it found no evidence that private keys had been exposed.
The breach is the latest in a series of exchange cyberattacks, but by far the largest in value. Binance has said it will publish a detailed post-mortem and an updated Proof of Reserves once its investigation ends. Most customers kept their funds on the platform, the exchange’s figures show. The outflows were far smaller than the exchange’s total reserves. Binance did not immediately respond to a request for further comment.