Investors have withdrawn approximately $3.6 billion in net funds from Binance, the world’s largest cryptocurrency exchange, following a record $6.3 billion cyberattack that the United States Federal Bureau of Investigation (FBI) has attributed to North Korean state-sponsored hackers.
The massive withdrawals followed the exchange’s decision to gradually restore access to customer funds after temporarily suspending transactions in response to the October 29, 2026, security breach, described by cryptocurrency analysts as potentially the largest financial theft in history.
According to figures released by Binance on Sunday, November 1, customers withdrew approximately $4.6 billion from the platform while depositing about $1 billion during the same period, resulting in net withdrawals of approximately $3.6 billion.
The amount represents about 2.1 per cent of the exchange’s $171 billion in total assets under management, according to its latest available proof-of-reserves figures.
Binance confirmed the transactions as part of its efforts to reassure customers about the safety of their remaining assets and demonstrate its financial capacity to withstand the consequences of the attack.
The company explained that although withdrawal requests increased sharply when transactions resumed, the volume subsequently declined as customers regained access to their accounts.
“After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial,” Binance stated.
The exchange said its security teams were continuing to assess affected networks and digital assets before restoring full withdrawal services.
“We know how important safe and reliable access to your funds is and will share details of the next phase as soon as we can,” the company assured customers in a statement posted on X.
Binance initially suspended withdrawals after hackers gained unauthorised access to its systems and transferred cryptocurrency assets worth approximately $6.3 billion.
The attack, which occurred on Thursday, October 29, prompted an international investigation involving cybersecurity experts, blockchain intelligence companies and United States law enforcement agencies.
Following preliminary assessments, security researchers identified a North Korean hacking operation known as TraderTraitor as the likely perpetrator.
On Saturday, October 31, the FBI formally attributed the theft to the North Korean-linked group, confirming suspicions earlier raised by private cybersecurity investigators.
In its statement, the FBI said, “The Federal Bureau of Investigation is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6bn in virtual assets from cryptocurrency exchange Binance, on or about October 29.”
TraderTraitor is associated with North Korea’s wider state-sponsored cybercrime operations and is believed to be connected with the Lazarus Group, which has been implicated in several major international cyberattacks.
The Lazarus Group attracted worldwide attention in 2014 after being accused of carrying out a cyberattack against Sony Pictures, an incident linked to the release of The Interview, a film depicting North Korean leader Kim Jong-un.
According to United States investigators, the hackers responsible for the Binance theft had begun converting stolen cryptocurrency into Ethereum as part of attempts to move and conceal the proceeds.
The FBI warned that the stolen assets could subsequently be laundered through decentralised finance platforms and instant cryptocurrency exchange services.
The agency consequently urged cryptocurrency companies, blockchain service providers and other financial technology operators to prevent transactions involving wallet addresses identified as being connected to the stolen assets.
The investigation is being conducted with support from the United States Secret Service and the Internal Revenue Service Criminal Investigation Division.
Meanwhile, Binance has intensified efforts to replenish the stolen funds and restore customer confidence following the security breach.
The company announced on Saturday that it had replenished approximately 90 per cent of the stolen assets through its financial reserves and other resources.
It explained that the remaining 10 per cent consisted partly of less liquid digital assets that could take longer to acquire in sufficient quantities.
Binance co-chief executive, Richard Teng, assured customers that the exchange would cover the outstanding amount and that users would not bear the financial consequences of the attack.
Teng said the company was “committed to covering the remaining 10%,” reiterating that Binance would take responsibility for the stolen funds.
The exchange had earlier disclosed that it set aside approximately $6.34 billion to compensate customers affected by the breach.
According to the company, the funds required to replenish customer holdings were being drawn from its Secure Asset Fund for Users, futures insurance fund and corporate treasury.
The Secure Asset Fund for Users is a financial reserve established by Binance to provide additional protection for customers in the event of security incidents.
The company also said it had obtained replacement cryptocurrency through market purchases and other arrangements to restore affected balances.
As part of its recovery process, Binance announced a phased reopening of withdrawal services on Sunday, initially allowing transactions involving 15 networks and digital assets.
The first phase included Ethereum, Tether’s USDT and Circle’s USDC stablecoins operating on the Ethereum blockchain, alongside selected assets supported by the BNB Smart Chain.
Later on Sunday, the exchange restored transactions involving Dogecoin and Avalanche through their respective blockchain networks.
Binance maintained that the phased approach was necessary to ensure that withdrawal services were restored safely without exposing customers to further security risks.
The exchange said its technical teams were continuing extensive testing of the remaining networks and assets before allowing additional withdrawals.
The company also indicated that the sharp increase in withdrawals following the initial reopening had begun to moderate, while customer deposits remained substantial.
The developments come amid growing concern about the security of centralised cryptocurrency exchanges and the increasing sophistication of cyberattacks attributed to state-backed hacking groups.
The Binance incident has also raised questions about the effectiveness of security measures protecting large digital asset platforms, particularly those holding billions of dollars in customer funds.
North Korea has repeatedly been linked to cryptocurrency thefts, with international investigators alleging that proceeds from cybercrime have been used to obtain foreign currency and support activities restricted by international sanctions.
The latest attack represents one of the most financially damaging incidents recorded in the cryptocurrency industry.
The breach also triggered instability in cryptocurrency markets, with Bitcoin and other major digital assets declining sharply immediately after news of the theft emerged.
However, Binance has maintained that the exchange possesses sufficient financial resources to absorb the losses and continue operating.
Its latest withdrawal figures indicate that although customers moved billions of dollars out of the platform after transactions resumed, the net outflow represented a relatively small proportion of the exchange’s reported total assets.
The company is expected to provide further information through an updated proof-of-reserves report, while investigations continue into the methods used by the hackers and efforts to trace and recover the stolen digital assets.
Post Title: “Withdrawal Volumes Are Stabilising” — Binance Confirms $3.6bn Investor Exodus After Record $6.3bn Hack Linked To North Korea By Naijaonpoint.