Binance outflows keep climbing after $6.3B North Korea hack

Customers pulled billions of dollars from Binance after the world's largest cryptocurrency exchange reopened withdrawals on Sunday, Nov. 1. The exchange had shut them off after a $6.3 billion theft that the FBI blamed on North Korea. Binance said it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 6:00 and 15:30 GMT, a net outflow of about $3.64 billion, according to the BBC. The outflows kept going into Monday. A Binance spokesperson told Bloomberg that net withdrawals had reached $4.7 billion by Monday morning in London.bloomberg.com+1

Outflows and reassurances

Binance said the first day's net outflow equaled 2.1% of its $171 billion in total assets, based on proof-of-reserves data from Oct. 28, CNBC reported. Bloomberg used a different measure and said the $4.7 billion was still less than 4% of the $128 billion held on the platform. The exchange said withdrawals spiked at first but then fell and were "stabilising as expected".cnbc.com+2

Binance said it had replaced about 95% of the stolen assets with company money, up from 90% in an earlier update. It added that the last 5% consists of less liquid tokens that will take longer to buy. Founder Changpeng Zhao wrote on X that "98% choose to stay," and added, "Trust isn't earned by what you say in good times. It's earned by what you do in hard times".cnbc.com

Withdrawals are coming back in stages. The first phase covered 15 networks and assets, including Bitcoin ↗ 1.33% and Ether Ethereum ↗ 1.97%. On Monday, Binance restored fiat withdrawals in U.S. dollars, UAE dirhams, Vietnamese dong, Philippine pesos and Indonesian rupiah, bringing the total to 28 currencies.helpnetsecurity.com+1

The North Korea link

In an alert on Saturday, Oct. 31, the FBI said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets" from Binance on or about Oct. 29. It named the attackers as TraderTraitor, the same group it blamed for the $1.5 billion Bybit hack in February 2025. The bureau said the hackers were converting the stolen funds mainly into Ethereum. It asked crypto businesses to block transactions involving hundreds of addresses it has linked to the theft.finance.yahoo.com+1

Binance has said the attackers may have gotten in through a compromised laptop belonging to a DevOps engineer. Tether, Circle ↗ 4.36% and other partners froze close to $3 billion of the stolen funds within the first day. Circle told CNBC it had frozen more than $1.1 billion in USDC USD Coin tied to the attack. Chainalysis said the hackers may have used artificial intelligence to process "thousands of transactions in a brief timeframe," The New York Times reported.helpnetsecurity.com+2