Binance Customers Withdraw $3.64 Billion After $6.3 Billion Hack as Exchange Reopens
Binance customers withdrew a net $3.64 billion in the first hours after the exchange reopened on 1 November following the $6.3 billion hack the FBI links to North Korea. Binance says flows are stabilising and 95% of stolen assets are covered.
Binance customers pulled a net $3.64 billion out of the world’s largest cryptocurrency exchange in the first hours after it reopened on Sunday, 1 November, following the record $6.3 billion hack that the FBI has linked to North Korea. The outflow — about 2.1% of the exchange’s assets — is the first hard measure of how much trust the breach cost Binance, and the exchange says the pace of withdrawals is already stabilising.
Highlights
- Net outflow: $3.64 billion between 06:00 and 15:30 GMT on Sunday, 1 November — $4.649 billion withdrawn against $1.01 billion deposited, according to Binance’s own post on X.
- Share of assets: About 2.1% of the $171 billion in total assets Binance reported as of 28 October.
- The hack: $6.3 billion stolen on or about 29 October; the FBI attributes it to TraderTraitor, a North Korean state-sponsored unit.
- Cover: Binance says it has covered about 95% of the stolen assets by buying replacement tokens with its own funds.
- Disputed count: Analytics platform DefiLlama put outflows higher, at $5.81 billion; Binance disputes that figure.
The numbers, in Binance’s own words
The withdrawal figure comes from Binance itself. In a post on X on Sunday, the exchange said:
“Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion.”
That statement was reported by the BBC as carried by Ada Derana on 2 November, and the same $3.64 billion figure, described as 2.1% of Binance’s assets, was reported by Reuters as published by The Hindu BusinessLine on 2 November. Binance said it held $171 billion in total assets under management as of 28 October and has 335 million registered users globally Reuters reported. This is the follow-up to the $6.3 billion hack in which the FBI blamed North Korea as withdrawals resumed in phases, and the scale of Sunday’s outflow is the part of that story the market was waiting to see.
Binance said the rush was front-loaded. In its update, the company said:
“After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial.”
That wording was reported by the BBC as carried by Newswire on 2 November. Withdrawals are being restored in stages, prioritising the tokens users want most. Binance said in an earlier post on X:
“We are taking a phased approach by prioritising tokens based on the past week data of user demand.”
The first phase covered 15 tokens including bitcoin, ether, some USDC and USDT stablecoins and dogecoin Reuters reported via BusinessLine, and Binance has since reopened withdrawals on more networks, including Zcash, TON and Sui, and restored fiat withdrawals in several currencies on Monday Decrypt reported on 2 November.
95% covered — and a fight over the outflow count
Binance says it has covered about 95% of the stolen assets — roughly $6 billion of tokens bought back with company money — and that the remaining 5% consists of less liquid tokens that may take longer to source Reuters reported. The exchange had earlier said it reserved more than $6.34 billion to deal with the fallout the BBC reported via Ada Derana. Co-chief executive Richard Teng said Binance would absorb the financial impact rather than pass it to users Decrypt reported.
The one number the two sides do not agree on is the outflow itself. Crypto analytics platform DefiLlama’s dashboard put outflows at $5.81 billion, revised up from an earlier $4.36 billion, while Binance’s own net figure is $3.64 billion Reuters reported. A Binance spokesperson responded to the initial DefiLlama data:
“This figure does not contain the flows we have deposited to our own new hot wallet, so they are not accurate. Our last update on X is closest to accurate (outstanding the moves in both deposits and withdrawals since it was posted).”
That dispute matters because gross wallet movements and net customer withdrawals measure different things: transfers between Binance’s own wallets inflate the gross figure without any customer leaving. The market backdrop is still fragile either way — as Titans Infos reported when the breach pushed bitcoin to a six-week low, prices have only partly recovered, with bitcoin trading above $78,000 on Monday after Friday’s low and ether at about $2,287 after hitting a two-month low Reuters reported. Spot bitcoin ETFs shed $643 million on Friday, the largest daily outflow of October, and more than $1.3 billion in leveraged positions were liquidated, according to Ari Redbord of blockchain analysis firm TRM Labs as reported by BusinessLine — the same risk-off mood that drove the Nasdaq’s worst month since 2022 in the October AI selloff.
Who the FBI blames — and the one dissenting voice
The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored cyber unit also associated with the Lazarus Group, carried out the attack. In its advisory, the bureau said:
“The Federal Bureau of Investigation is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6bn in virtual assets from cryptocurrency exchange Binance, on or about October 29.”
That advisory was reported by the BBC as carried by Newswire. The bulk of the theft unfolded in about 20 minutes late on Thursday, 29 October, and bore similarities to earlier attacks blamed on North Korea, according to TRM Labs and Chainalysis Reuters reported. The FBI said it had seen the hackers converting stolen assets mainly into ether and expected further laundering through DeFi and instant swap services Decrypt reported. North Korea has for years denied running state-linked cyber units, and its Geneva mission and Beijing embassy did not respond to requests for comment Reuters reported.
US President Donald Trump, however, stopped short of endorsing the attribution on Saturday. He told reporters:
“We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it.”
That comment was reported by Reuters via BusinessLine on 2 November. The hack hit Binance’s global platform, Binance.com; its US-facing platform said it was not affected the BBC reported.
How users and analysts reacted
Reaction from industry figures has been measured rather than panicked. Ari Redbord, global head of policy at TRM Labs, explained why institutional investors are uneasy, telling Reuters:
“A hack at a financial institution means stolen usernames and passwords. A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people’s capital.”
Jay Koh, vice president at the Asia Web3 AI Association, said he had not withdrawn his own holdings because most were in a cold wallet that the hack did not touch, but he advised caution:
“I would not necessarily withdraw everything from Binance … However, I do think it is prudent to review exposure, diversify custody arrangements and avoid keeping more assets on any single platform than necessary.”
Both comments were reported by Reuters via BusinessLine on 2 November.
What to watch next
Three things will decide whether Sunday’s $3.64 billion outflow was the peak or the start. First, Binance’s updated proof-of-reserves report, expected on Monday after a fresh snapshot on 31 October, will be checked against the $171 billion figure. Second, whether the remaining 5% of stolen tokens — the illiquid ones — are covered as promised. Third, whether deposit volumes stay “substantial” once every network is fully reopened, because an exchange can survive a one-day rush far more easily than a slow bleed. For now, the verified position is narrower than the headlines: customers took out a net $3.64 billion in nine and a half hours, the exchange says the flow is stabilising, and the largest theft in crypto history is now a test of whether size itself is enough to hold users’ trust. This article reports the figures attributed above and is not investment advice.
