Binance users withdraw $3.6bn after largest-ever crypto hack

Binance customers withdrew $3.6bn (£2.7bn) of assets from the world's biggest cryptocurrency exchange on Sunday as it reopened following what is believed to be the largest hack in history. The firm suspended all transactions in the wake of the incident, which affected $6.3bn worth of digital assets. Major organisations, including the US Federal Bureau of Investigation (FBI), have accused North Korea of being responsible for the cyber-attack. In a statement on X, Binance said: "Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion." The company said there was an "initial spike" in withdrawals that later declined and were "stabilising as expected". Sunday's net withdrawals account for just over 2% of the $171bn of assets under Binance's management, according to the firm. Binance said it has covered around 95% of the assets stolen in the breach, though the remaining amount may take longer to source. The company has repeatedly said it would cover all losses linked to the attack, and last week it said it had reserved more than $6.3bn in funds to deal with the fallout. It said customer assets have been replaced using a combination of sources, including its corporate treasury, futures insurance fund and emergency reserve fund. "Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident," the firm said. Withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, and the exchange said more services will return in phases once security checks are completed. Funds linked to the hack continue to be laundered, according to Alec Zebrick, senior manager in global services at blockchain analysis firm Chainalysis, which has been working with Binance and governments to recover the stolen money. "We continue to see funds being laundered quite actively," he told the BBC's Today Programme. "The attackers are layering these funds across many thousands of addresses, across thousands of deposits," he added. The attack has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group, which stole a then-record $1.5bn from the crypto exchange Bybit in 2025. On Saturday, the FBI published a list of cryptocurrency wallet addresses linked to the group and urged industry partners to help by blocking transactions involving them. Binance said it had scrambled to urge cryptocurrency issuers to freeze affected assets. Binance said last week that early checks suggest the incident may have started with a compromised laptop belonging to an engineer, which allowed hackers to find a way to make unauthorised transactions. The hack hit Binance's global centralised exchange, Binance.com, while the company's US-facing platform said it was not affected. Cryptocurrencies are digital assets traded on exchanges such as Binance. Unlike cash, they do not exist in physical form and are managed on computers, smartphones and other digital devices. Binance was founded in China and has hundreds of millions of registered users globally.