Following a massive cyber heist attributed to North Korean hackers, billions have been withdrawn from Binance, the leading cryptocurrency exchange, as it races to restore services and reassure its users.
In the wake of an unprecedented breach, customers have withdrawn $3.6 billion (£2.7 billion) from Binance, marking what may be the largest theft in the cryptocurrency industry to date.
On Sunday, a significant number of withdrawals occurred as Binance resumed access to users’ digital assets after a cyber-attack, which the FBI has linked to North Korean cybercriminals.
During the late-month assault, approximately $6.3 billion in digital currencies were stolen, leading Binance to temporarily halt transactions while it investigated the incident and worked to restore user access to their funds.
In a message shared on X yesterday, Binance reported: “From 06:00 to 15:30 UTC on November 1, we managed $4.649 billion in outflows and $1.01 billion in inflows, which resulted in a net withdrawal of about $3.64 billion.”
The firm, which operates under regulations in Abu Dhabi, indicated that the pace of withdrawals was slowing, asserting that the net outflow constituted just 2.1% of its total reported assets of $171 billion.
“After the initial surge, the volume of withdrawals is stabilizing as expected, and deposits remain solid,” the firm noted.
The attack that led to the suspension of Binance’s transactions has been linked by the FBI to TraderTraitor, a hacking group from North Korea known to be affiliated with the infamous Lazarus Group.
Previously, the same network was implicated in the theft of $1.5 billion from Bybit, another cryptocurrency exchange, in 2025, which was considered the largest theft in the sector at that time.
It is believed that the breach of Binance may have started with a compromised engineer’s device, which could have allowed hackers to access systems for transaction authorizations.
Binance reported that it has replaced approximately 95% of the lost funds to safeguard its customers, though replenishing the remaining amount may require additional time.
Meanwhile, investigators face challenges in tracing the stolen assets as hackers transfer the funds across numerous digital accounts, complicating recovery efforts.
Alec Zebrick, a senior manager with blockchain analytics firm Chainalysis, which is collaborating with Binance and authorities, stated on the BBC’s Today programme that the stolen assets are still actively being circulated.
“We continue to witness ongoing laundering of the funds,” he added.
The exchange has committed to protecting customer losses through its corporate treasury, insurance funds, and emergency reserves, opting not to burden account holders with the financial fallout.
READ MORE: Security Chief Alerts: North Korean Agents Infiltrating Western Companies Using Deceptive Methods. State-sponsored hackers from North Korea and other adversarial nations are utilizing fake personas, manipulated interviews, and stolen credentials to infiltrate Western firms. With advancements in AI, their tactics are becoming increasingly sophisticated and challenging to detect, according to one of the UK’s leading cybersecurity officials.
Do you have insights or news to contribute? The European invites updates from industry leaders and experts. Contact our editorial team for more information.
Main image: The cryptocurrency exchange Binance witnessed net withdrawals of $3.64 billion (£2.7 billion) following the resumption of services after a record-setting cyber-attack attributed to North Korean hackers, during which an estimated $6.3 billion in digital currencies were compromised. Credit: Binance.