Binance Users Withdraw $3.6 Billion After Largest-Ever Crypto Hack

Binance Users Pull $3.6 Billion After Record Crypto Attack

Customers of Binance have withdrawn approximately $3.64 billion in cryptocurrency after the world’s largest crypto exchange resumed withdrawals following a devastating cyberattack that resulted in the theft of an estimated $6.3 billion in digital assets.

The huge movement of funds came as Binance gradually restored its services after temporarily suspending withdrawals while it investigated the attack and carried out security checks. The scale of the withdrawals highlights the immediate concern among customers following what is being described as the largest cryptocurrency theft ever recorded.

According to figures released by Binance, the exchange processed $4.649 billion in withdrawals between 6:00am and 3:30pm GMT on November 1, while deposits during the same period reached approximately $1.01 billion. The difference resulted in a net outflow of about $3.64 billion.

Despite the enormous amount leaving the platform, Binance said the initial surge in withdrawals had begun to slow and was moving towards more stable levels. The company also pointed out that the net outflow represented slightly more than two per cent of the approximately $171 billion in assets it had under management.

A Massive Test of Customer Confidence

The withdrawal figures provide an early indication of how customers are reacting to the security breach.

For a cryptocurrency exchange, confidence is particularly important because customers can move digital assets away from a platform almost instantly. Following a major security incident, even users whose funds were not directly affected may decide to transfer their holdings elsewhere until they are satisfied that the exchange is safe.

That appears to have been part of the immediate reaction following Binance’s reopening.

The exchange had suspended withdrawals after the attack as its security teams worked to contain the incident. Once access was restored in phases, customers quickly moved billions of dollars.

However, the figures also show that customers continued depositing funds during the same period. The $1.01 billion in deposits helped reduce the overall net amount leaving the exchange and suggested that some users remained willing to keep their assets on the platform despite the breach.

Binance has therefore attempted to present the withdrawals as an expected response to the incident rather than evidence of a complete loss of confidence.

How the $6.3 Billion Hack Happened

The cyberattack occurred on October 29 and targeted Binance’s hot wallets across multiple blockchain networks.

Blockchain intelligence company Elliptic estimated the total stolen amount at approximately $6.43 billion, while Binance has publicly used a figure of around $6.3 billion. The theft involved numerous digital assets and occurred across several networks.

The scale of the operation was extraordinary.

According to blockchain investigators, a significant portion of the stolen assets was removed within a relatively short period, with billions of dollars moved through cryptocurrency addresses controlled by the attackers.

Binance initially indicated that the attack may have involved a compromised laptop belonging to a DevOps engineer. The compromise allegedly provided attackers with a pathway that allowed unauthorised withdrawal transactions to be submitted through internal systems.

The exchange has since said its investigation identified additional points of compromise, suggesting that the incident was more complicated than a single compromised device.

The attack affected Binance’s global platform, while its US-facing operation was reported not to have been affected.

North Korean Hackers Blamed

Investigators have linked the attack to North Korea’s TraderTraitor cybercrime group, which has also been associated with some of the largest cryptocurrency thefts in recent years.

The United States Federal Bureau of Investigation has attributed the attack to the group, which is also associated with the notorious Lazarus Group. The same network has previously been linked to the $1.5 billion theft from cryptocurrency exchange Bybit in 2025.

The suspected involvement of a state-linked hacking operation has added another layer to the incident.

North Korean cyber operations have repeatedly targeted the cryptocurrency sector because digital assets can potentially generate large amounts of money while offering attackers sophisticated methods for moving funds across jurisdictions.

Following the Binance attack, the FBI published cryptocurrency wallet addresses associated with the suspected hackers and urged companies within the digital-asset industry to help identify and block transactions connected to the stolen funds.

Binance Says 95% of Stolen Assets Have Been Covered

One of Binance’s most important efforts since the attack has been reassuring customers that they will not be left responsible for the losses.

The exchange says it has already covered approximately 95 per cent of the stolen assets. It has used company resources, emergency reserves and other funds to replace affected assets, while also working with industry partners and authorities to freeze or recover cryptocurrency connected to the attackers.

Binance has said it will absorb the financial impact of the incident rather than pass the losses on to customers.

The company previously disclosed that it had reserved more than $6.3 billion to deal with the consequences of the breach. According to CoinDesk, more than $5 billion of that amount was already held in the same token assets that had been stolen, with Binance sourcing the remainder through market purchases and over-the-counter transactions.

The remaining five per cent of the affected assets could take longer to replace because they consist largely of less liquid cryptocurrencies that are harder to obtain in sufficient quantities.

Billions of Dollars Still Being Traced

Recovering the stolen cryptocurrency remains a major challenge.

Blockchain investigators have been monitoring the attackers’ wallets as funds move between thousands of addresses. Analysts say the hackers have used increasingly complicated methods to make the stolen assets harder to trace.

Chainalysis has reported that the stolen funds continue to be actively laundered, with transactions spread across numerous wallets. The rapid movement of the assets makes it more difficult for exchanges, investigators and authorities to freeze them before they are converted or transferred through additional networks.

Some of the stolen funds have already been frozen by cryptocurrency companies.

Elliptic reported that approximately $2.85 billion of the stolen funds had been frozen or seized, representing a substantial portion of the total loss. The company also observed attackers swapping some assets into cryptocurrencies that are more difficult to freeze and moving funds between different blockchain networks.

Binance Gradually Restores Services

Following the attack, Binance did not immediately restore every service.

The exchange adopted a phased approach, allowing withdrawals for major cryptocurrencies including Bitcoin and Ethereum, alongside several other digital assets and stablecoins. Additional networks and services were expected to return after further security checks.

The cautious reopening was designed to prevent another incident and give Binance’s technical teams time to verify that its systems were secure.

For customers, however, the gradual restoration also created a tense waiting period.

Many users were eager to regain access to their funds after withdrawals were suspended, particularly those who wanted to move their holdings to private wallets or other exchanges.

The successful processing of billions of dollars in withdrawals without another major disruption represents an important step in Binance’s recovery.

What the Hack Means for the Crypto Industry

The Binance incident is likely to intensify discussions about security within the cryptocurrency industry.

Centralised exchanges hold enormous amounts of digital assets, making them attractive targets for sophisticated cybercriminal organisations. A single successful attack can result in billions of dollars in losses and potentially affect millions of customers.

The incident also demonstrates why exchanges need multiple layers of protection around withdrawal systems.

Security experts are expected to examine how attackers gained access, how unauthorised transactions were approved and why existing safeguards did not prevent the movement of such a large amount of cryptocurrency.

For Binance, the next stage will involve demonstrating that the vulnerabilities responsible for the attack have been addressed.

The company has also indicated that it intends to provide further information about the incident once its investigation is complete.

A Crucial Moment for Binance

The $3.64 billion withdrawal figure is significant, but it does not necessarily mean Binance is facing a mass customer exodus.

The exchange continues to hold a huge amount of customer assets, while deposits have remained substantial following the reopening. Binance has also stressed that withdrawal activity began stabilising after the initial surge.

Nevertheless, the attack has created a difficult period for the company.

Binance now has to convince customers, regulators and the wider cryptocurrency industry that its systems can withstand another sophisticated attack. Its decision to cover the losses could help protect customer confidence, but rebuilding trust after a record-breaking security breach will likely take much longer than restoring withdrawals.

The incident also serves as another warning about the risks surrounding digital assets. Cryptocurrency transactions can move across borders within seconds, and once stolen funds begin passing through multiple wallets and blockchain networks, recovery can become extremely complicated.

For Binance users, the immediate priority is access to their money. For the exchange, the bigger challenge is proving that the systems protecting those assets are strong enough to prevent another crisis.

With billions of dollars already withdrawn and billions more still being tracked, the Binance hack has become a defining moment for the cryptocurrency industry — and its consequences could extend well beyond the exchange itself.