Binance users pull $3.6bn after record crypto hack as exchange reopens

Customers of Binance, the world's biggest cryptocurrency exchange, withdrew $3.6bn (about £2.7bn) in assets on Sunday as the platform came back online following what is believed to be the largest hack ever recorded.

The company froze all transactions after the incident, which affected digital assets valued at $6.3bn. Several major organisations, among them the US Federal Bureau of Investigation, have blamed North Korea for the attack.

Binance said it has already replaced roughly 95% of the stolen assets, though sourcing the remainder could take more time. It has repeatedly pledged to make customers whole for every loss connected to the breach.

In a post on X, the exchange said: "Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion." It added that an "initial spike" in withdrawal requests later eased and is "stabilising as expected".

The company stressed that Sunday's net outflows represent just over 2% of the $171bn in assets under its management. It said last week that it had set aside more than $6.3bn in funds to handle the fallout from the attack, using its corporate treasury along with futures insurance and emergency reserve funds to replace customer assets.

Binance also confirmed that withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, are working again, with additional services to return in phases as security checks are completed.

Meanwhile, the stolen funds are still being moved, according to Alex Zebrick, a senior investigator at Chainalysis who is working with the exchange and governments to recover the money. "We continue to see funds being laundered quite actively," he told the BBC's Today Programme. "The attackers are layering these funds across many thousands of addresses, across thousands of deposits," he added.

The attack has been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group, which was behind the theft of a then-record $1.5bn from the crypto exchange Bybit in 2025. On Saturday, the FBI published a list of cryptocurrency wallet addresses tied to the group and called on industry partners to block transactions involving them. Binance itself rushed to persuade cryptocurrency issuers to freeze the affected assets.

According to Binance, early findings suggest the breach may have begun with a compromised laptop belonging to an engineer, which allowed the hackers to make unauthorised transactions. The attack struck Binance.com, its global centralised exchange, while the company said its US-facing platform was not affected. "Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident," the firm said.

Cryptocurrencies are digital assets traded on exchanges like Binance. Unlike physical cash, they exist only on computers, smartphones and other digital devices. Binance, founded in China, says it has hundreds of millions of registered users around the world.