Binance customers have withdrawn more than $7.4 billion from the cryptocurrency exchange following a cyberattack that resulted in the theft of approximately $6.3 billion in digital assets. The company has replaced about 95% of the affected funds and is gradually restoring normal operations.
The exchange reopened withdrawals on Sunday, November 1, after temporarily suspending transactions while investigating the breach. By Monday, customers had withdrawn roughly $7.42 billion and deposited another $2.7 billion, leaving Binance with net outflows of approximately $4.7 billion.
Binance said those withdrawals represented about 3% of its reported $157 billion in assets. A company spokesperson said withdrawal activity was beginning to return to normal levels.
The attack was first disclosed on October 29, when Binance announced that unauthorized parties had gained access to systems responsible for approving cryptocurrency withdrawals. Investigators initially identified a compromised engineer’s laptop as a possible entry point, but the company later discovered additional security breaches.
The FBI has linked the theft to TraderTraitor, a hacking group associated with North Korea. Federal investigators said the group was converting much of the stolen cryptocurrency into Ethereum in an effort to conceal the movement of funds. The same group was connected to the February 2025 attack on cryptocurrency exchange Bybit, which resulted in approximately $1.5 billion in losses.
Binance has committed more than $6.34 billion of its own resources to replacing the stolen assets. The money is coming from several sources, including the company’s Secure Asset Fund for Users, its futures insurance fund and corporate treasury.
By October 31, Binance had restored coverage for about 90% of the affected assets. That figure increased to approximately 95% by November 1. Ten major cryptocurrencies, including Bitcoin, Ethereum, Solana, XRP and several stablecoins, were fully backed.
The remaining assets are less liquid and have been more difficult to replace in large quantities. Binance is purchasing additional tokens through regular markets and private transactions to cover the outstanding amount.
Other cryptocurrency companies have helped prevent some of the stolen funds from moving further. Stablecoin issuers Tether and Circle froze more than $2.38 billion combined, while Ripple separately blocked approximately $200 million.
Binance reported that roughly $3 billion in stolen assets had been frozen. Those funds are not necessarily recovered, since freezing cryptocurrency prevents transfers but does not automatically return the assets to their owners.
Withdrawal services are also returning in stages. Bitcoin, Ethereum and several other major networks were included in the initial reopening, with additional cryptocurrencies becoming available after security checks. Customers may still experience delays as Binance monitors transactions and network activity.
The company has maintained that customers will not be required to cover the losses themselves. It also announced plans to release an updated Proof of Reserves report, allowing users to verify whether their account balances are backed by assets held by the exchange.
Binance’s separate United States platform was not affected by the attack. The company is continuing its investigation while working to replace the remaining stolen assets and restore withdrawal access across its supported networks.
This image is the property of The New Dispatch LLC and is not licenseable for external use without explicit written permission.
