NEW YORK / CryptoWire.AI / – Binance recorded a net outflow of $3.64 billion after reopening withdrawals on Sunday, November 1, following a record $6.3 billion hack. Customers withdrew more than $4.6 billion, while deposits totaled just over $1 billion, the exchange said in a social media post. The transactions covered Bitcoin, Ethereum and other cryptocurrencies. Binance said the outflow equals just 2.1% of its $171 billion in total assets.
Binance has more than 300 million users and is the world’s largest crypto exchange. Founder Changpeng Zhao said on X that 98% of users chose to stay. Most of the net outflows came within the first couple of hours after withdrawals restarted across 15 networks. Cofounder Yi He said early Monday that the top priority is making the environment secure so users can withdraw funds and operations can resume.
Binance has pledged to cover all losses from the hack with company funds. By early Sunday morning, the exchange said it had covered around 95% of the affected amount. About $3 billion of the stolen assets has been frozen, according to Binance. Freezing allows certain token issuers to block transfers of their tokens anywhere in the world. Binance did not immediately respond to a request for comment, CBS News reported on Monday.
North Korean group launders funds
The FBI has linked the attack to North Korea and named the hacker group TraderTraitor as the likely culprit. On Saturday, the bureau said the group was converting most of the stolen assets into Ethereum to cover its tracks. Blockchain analysts had already tied the attack to North Korean hackers linked to the Lazarus Group. Firms including TRM Labs and Chainalysis traced the theft across 10 blockchains within hours of the breach.
TraderTraitor was also responsible for the February 2025 attack on rival exchange Bybit, which caused a $1.5 billion loss, according to the FBI. The Binance theft is about four times larger. The FBI urged private-sector entities to block transactions with or derived from addresses that TraderTraitor actors are using to launder the stolen assets. Investigators are racing to freeze more funds before the hackers can cash them out.
Scam warning follows restart
Binance issued a scam warning on Monday, a day after withdrawals resumed. Large breaches often draw fraudsters who target anxious users with fake support messages or recovery offers. Authorities have warned about similar tactics, including INTERPOL videos warning the public about deepfake scams. Users are advised to rely only on official Binance channels for updates on their accounts and funds, and never to share passwords or verification codes.
The hack began late on Thursday, October 29, when attackers drained Binance wallets in about 20 minutes. Binance initially suspended deposits and withdrawals while it investigated, and later found additional points of breach. The exchange says it is working with law enforcement. The size of the outflow will be closely watched as a test of customer confidence in the world’s biggest crypto platform. Analysts will also track whether deposits recover in the days ahead.