Digital asset users pulled approximately $3.6 billion from Binance following the platform's reopening on Sunday after a major cyberattack that impacted $6.3 billion in cryptocurrencies. The massive capital flight occurred as trading services resumed, with international investigators and the US Federal Bureau of Investigation attributing the security compromise to North Korean state- sponsored actors.
Between 06:00 and 15:30 GMT on November 1, the cryptocurrency platform recorded $4.649 billion in withdrawals against $1.01 billion in deposits, leading to a net asset reduction of roughly $3.64 billion. While transaction volumes initially spiked upon service restoration, exchange executives reported that platform activity subsequently normalised.
How is the exchange managing the financial impact?
Despite the substantial capital outflow, platform representatives noted that the withdrawals accounted for just over two percent of the total $171 billion in customer reserves managed by the firm. The company reiterated its commitment to absorbing the full financial cost of the breach without passing losses to users.
According to corporate statements, the platform has replenished about 95 percent of the compromised funds using internal corporate treasuries, futures insurance provisions, and emergency reserves, though reclaiming the remaining balance may require extended investigative efforts. Last week, leadership confirmed that over $6.3 billion had been earmarked to handle fallout from the incident.
What are investigators saying about the stolen funds?
Recovery operations remain challenging due to ongoing laundering tactics employed by the perpetrators. Alec Zebrick, senior manager in global services at blockchain intelligence firm Chainalysis, indicated that the hackers are rapidly fragmenting the stolen capital across thousands of distinct digital wallets to obscure tracking.
Intelligence agencies have tied the security breach to TraderTraitor, a cybercrime faction originating from North Korea also referenced as the Lazarus Group. The same collective was previously connected to a historic $1.5 billion heist targeting the Bybit trading platform in 2025. In response, law enforcement agencies published specific wallet addresses linked to the syndicate, urging industry stakeholders to block associated transactions while the exchange initiated internal audits pointing toward a compromised engineer workstation as the initial vector.