Binance Reopens After Record Hack, Net Outflows Reach $3.6 Billion
Seven Lights
Binance said it had replenished approximately 95 per cent of the assets stolen in last week’s $6.3 billion cyberattack, the largest theft in cryptocurrency history, as reopened accounts saw customers withdraw a net $3.64 billion on Sunday.
The exchange said withdrawals of $4.649 billion against deposits of $1.01 billion between 06:00 and 15:30 GMT on November 1 represented 2.1 per cent of the $171 billion of assets it manages. Over a longer window, net outflows reached $4.7 billion since accounts reopened after a suspension of roughly 45 hours. Binance described the Sunday figure as an “initial spike” that was “stabilising as expected”, and said it had reserved more than $6.3 billion to cover customer losses.
The theft itself took about 20 minutes, according to NPR, which cited Ari Redbord, global head of policy at TRM Labs, calling the raid “the largest bank robbery in human history”. Binance early checks suggested the intrusion may have begun with a compromised laptop belonging to an engineer, allowing hackers to authorise unauthorised transactions. The New York Times, publishing an account of the exchange’s first 24 hours, described a war room, a global conference call and a founder live-posting as the outflow unfolded.
Binance and Western agencies have attributed the attack to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group, which stole a then-record $1.5 billion from the exchange Bybit in 2025. Pyongyang has denied involvement. The FBI published a list of cryptocurrency wallet addresses linked to the group on Saturday and asked industry partners to block transactions involving them. Binance, working with other exchanges, has frozen about $3 billion of the stolen funds.
The company said the remaining portion of the stolen assets consists mainly of less liquid cryptocurrencies taking longer to purchase in quantity. Balances in major assets, including Bitcoin, Ether, BNB and Solana, were restored as withdrawals resumed in phases, with all 15 networks in the first reopening phase available by 12:36 p.m. on Sunday. Binance’s US-facing platform said it was not affected.
Some withdrawal restrictions remained in place as the phased restoration continued.