Binance customers withdrew $3.64bn in assets on Sunday as the world's largest cryptocurrency exchange reopened following a record hack that affected $6.3bn in digital assets.
The FBI and other major organisations have accused North Korea of conducting the cyber-attack, which sources attribute to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. The same group allegedly stole $1.5bn from crypto exchange Bybit in 2025.
Binance processed $4.649bn in withdrawals and $1.01bn in deposits between 06:00 and 15:30 GMT on November 1, the exchange said on X. The net outflow represented just over 2% of the $171bn in assets under Binance's management. The firm said the initial spike in withdrawals later declined and "are stabilising as expected."
Binance has covered around 95% of the stolen assets and said it will cover all losses from the attack. The firm reserved more than $6.34bn in funds to address the fallout, drawing on its corporate treasury, futures insurance and emergency reserve funds.
Early checks suggest a compromised laptop belonging to an engineer enabled hackers to make unauthorised transactions. Binance's US-facing platform was not affected. Withdrawals of major cryptocurrencies including Bitcoin and Ethereum have resumed, with other services to resume in phases once security checks are completed.
The FBI published a list of cryptocurrency wallet addresses linked to the North Korean group on Saturday and urged industry partners to block transactions involving them.