NEW YORK, United States / CryptoWire.AI / – Binance recorded net outflows of $3.64 billion after it reopened withdrawals on Sunday, as the FBI blamed North Korean hackers for the record theft from the exchange. Customers withdrew about $4.65 billion and deposited about $1.01 billion once transactions resumed. The exchange said the net figure represents 2.1% of its total assets of about $171 billion. Binance has more than 300 million users worldwide.
The figures cover the period from 6 a.m. to 3:30 p.m. UTC on November 1, when withdrawals for Bitcoin, Ether and other tokens returned in stages. Binance restored more networks afterwards, including Zcash, TON and Sui, and reopened U.S. dollar withdrawals on Monday, according to reports. Co-founder Yi He said some of the outflow reflected transfers between Binance’s own wallets rather than customer withdrawals. Most of the outflow came in the first hours after withdrawals reopened, according to reports.
In a post on X early Monday, Yi He said the exchange’s top priority was to secure its environment. After that, users could withdraw their funds and Binance could resume full operations, she wrote. The company has said customer funds are safe. By early Sunday, Binance said it had covered about 95% of the amount affected by the breach using company funds. It has pledged to cover the losses in full.
TraderTraitor converts funds into Ether
The FBI said on Saturday that TraderTraitor, a hacking group linked to North Korea, carried out the $6.3 billion theft. The group has been converting most of the stolen assets into Ethereum in an apparent effort to cover its tracks, the bureau said. It expects further laundering. The FBI has also tied TraderTraitor to the $1.5 billion Bybit attack in February 2025. TraderTraitor is part of the wider set of North Korean groups often referred to as the Lazarus Group.
The bureau asked private-sector entities to block transactions with, or derived from, addresses used by the group to launder the assets. Roughly $3 billion of the stolen funds have been frozen, according to Binance. Token issuers can freeze their assets at any blockchain address, blocking further transfers worldwide. Stablecoin issuers Tether and Circle froze funds linked to the breach soon after it was disclosed. Investigators continue to trace the remaining funds.
Largest crypto theft on record
Security experts have described the attack as the largest theft of digital assets ever. It is roughly four times larger than the Bybit hack. That previous record, a $1.5 billion loss, was also blamed on North Korea. Binance traced the breach to a compromised laptop belonging to a DevOps engineer, which gave an attacker access to a service container. From there, unauthorised withdrawals were submitted. The exchange said there was no evidence of a private key leak.
Hacks on centralised platforms have repeatedly hit the industry, from a $90 million cyberattack on Iran’s largest exchange in 2025 to the Bybit theft. Binance said it will release a detailed post-mortem and an updated Proof of Reserves when its investigation is complete. Its figures show that most customers kept their assets on the exchange after withdrawals resumed. The exchange did not immediately respond to a request for further comment.