The world’s largest cryptocurrency exchange has resumed operations after a massive cyber-attack, with customers withdrawing billions of dollars as investigators point to a North Korean hacking group.
Customers of Binance have withdrawn approximately $3.6bn (£2.7bn) in cryptocurrency assets following the reopening of the world’s largest cryptocurrency exchange after what is believed to be the biggest crypto hack in history.
The exchange temporarily suspended transactions following the cyber-attack, which compromised digital assets valued at approximately $6.3bn.
Major organisations, including the US Federal Bureau of Investigation (FBI), have attributed the attack to North Korea.
Binance said it had already secured funding to cover around 95% of the stolen assets, although recovering or replacing the remaining amount could take longer. The company has repeatedly promised to compensate customers for all losses resulting from the incident.
Billions withdrawn as Binance resumes operations
In a statement published on X, Binance revealed that it processed $4.649bn in withdrawals and $1.01bn in deposits between 06:00 and 15:30 GMT on 1 November.
This resulted in a net outflow of approximately $3.64bn.
The exchange said withdrawals initially surged following the reopening but later slowed, with activity stabilising as expected.
Despite the substantial withdrawals, Binance said the amount represented just over 2% of the $171bn in assets it manages.
The company had previously announced that it had reserved more than $6.3bn to manage the financial consequences of the attack.
Withdrawals involving more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed. Binance said additional services would return gradually after security checks were completed.
North Korean hackers suspected
Investigators have linked the attack to TraderTraitor, a North Korean cybercrime operation also known as the Lazarus Group.
The group has previously been associated with major cryptocurrency thefts, including the 2025 attack on exchange Bybit, in which approximately $1.5bn was stolen.
On Saturday, the FBI released a list of cryptocurrency wallet addresses connected to the suspected attackers and urged companies across the industry to block transactions involving those addresses.
Binance also contacted cryptocurrency issuers, asking them to freeze affected digital assets where possible.
However, efforts to recover the stolen funds remain challenging.
Alec Zebrick, senior manager in global services at blockchain analysis company Chainalysis, which is working with Binance and government agencies, said the stolen assets were still being actively laundered.
Speaking to the BBC’s Today Programme, he explained that the attackers were moving funds through thousands of different wallet addresses and deposits in an effort to obscure their origins.
How the security breach happened
Binance said preliminary investigations suggested the attack may have begun with a compromised laptop belonging to one of its engineers.
The device may have provided hackers with an opportunity to identify a vulnerability that allowed unauthorised transactions to take place.
The incident affected Binance.com, the company’s global centralised cryptocurrency exchange.
Binance’s US-facing platform said it was not affected.
The company has since replaced customer assets using several financial resources, including its corporate treasury, futures insurance and emergency reserve funds.
In a statement, Binance reiterated its commitment to covering the full financial impact of the breach.
Binance promises to cover customer losses
The exchange has insisted that customers will not be left responsible for the stolen funds.
Its compensation effort involves drawing on existing reserves and other corporate financial resources to restore affected assets.
The incident has nevertheless raised fresh questions about security at major cryptocurrency exchanges, particularly given the scale of the breach and the speed at which stolen funds can be transferred between digital wallets.
Founded in China, Binance has grown into the world’s largest cryptocurrency exchange, with hundreds of millions of registered users globally.
Cryptocurrencies are digital assets that can be traded through platforms such as Binance. Unlike traditional cash, they exist electronically and are stored and transferred using digital wallets and other computer-based systems.
With billions of dollars already withdrawn and investigators still tracing the stolen assets, Binance faces the challenge of restoring customer confidence while strengthening its security systems.
