Binance customers pulled a net $3.64 billion from the world's largest cryptocurrency exchange on Sunday as it resumed operations after hackers stole $6.3 billion in digital assets on Thursday, the biggest crypto theft on record.
From 6 a.m. to 3:30 p.m. GMT on Nov. 1, Binance said, it handled $4.649 billion in withdrawals against $1.01 billion in deposits. The company described an initial spike in withdrawals that later eased and was stabilizing as it had expected.
By Binance's count, the day's net outflow amounted to just over 2% of the $171 billion in assets it manages.
Covering the losses
Binance now says it has covered roughly 95% of the stolen assets, though the rest may take longer to obtain. On Saturday, the company had said it held enough of the same currencies to cover 90%, and it has repeatedly pledged to make customers whole.
To replace the assets, Binance said it drew on its corporate treasury along with its futures insurance and emergency reserve funds. Last week it said it had set aside more than $6.3 billion to handle the fallout.
Withdrawals of more than two dozen major cryptocurrencies, including bitcoin and ether, are running again. Other services will return in phases as security checks are completed, the company said.
FBI points to North Korea
The FBI said Saturday that the attack was carried out by North Korean hackers from a group known as TraderTraitor, also called the Lazarus Group, which stole $1.5 billion from the exchange Bybit in 2025. The bureau released a list of wallet addresses tied to the group and asked exchanges, blockchain analytics firms and others to block transactions involving them.
The FBI said the hackers had been converting the stolen assets mainly into ether and expects them to try decentralized finance platforms and instant swap services next.
It's bank robbery, in this case, at the speed of the Internet,
Ari Redbord, chief policy officer at TRM Labs
President Donald Trump, asked about the case Saturday night at a Halloween party at his Mar-a-Lago estate in Florida, said he was not concerned and suggested it was not yet certain North Korea was involved, though he allowed that it could still be determined.
Chasing the stolen funds
Alec Zebrick, a senior manager at Chainalysis, which is working with Binance and governments to recover the money, said the funds are still being actively laundered across thousands of addresses. Ari Redbord of TRM Labs expects the hackers to split the assets and move them through smaller exchanges, a process that could last months.
We continue to see funds being laundered quite actively,
Alec Zebrick, senior manager in global services at Chainalysis
Binance has said early checks suggest the breach may have begun with a compromised laptop belonging to an engineer, which let the attackers make unauthorized transactions. The hack struck Binance.com, the global exchange; the company's U.S.-facing platform said it was not affected.
