Binance, the world’s largest cryptocurrency exchange by daily trading volume, has resumed withdrawals following a $6.3 billion cyber heist, with customers withdrawing a net $3.64 billion in digital assets on Sunday as the United States Federal Bureau of Investigation (FBI) accused North Korea of orchestrating the attack.
The exchange disclosed that it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 6:00 a.m. and 3:30 p.m. GMT on November 1, resulting in a net outflow of approximately $3.64 billion.
The development followed the temporary suspension of transactions across the platform after hackers stole more than $6 billion in virtual assets in the October 29 security breach, described as the largest cryptocurrency heist on record.
In an update posted on its official X account, Binance said the initial surge in withdrawal requests had begun to ease, with transaction volumes gradually stabilising following the reopening of services.
“There was an initial spike in withdrawals, which later declined and are stabilising as expected”, the exchange said.
Binance explained that the net withdrawals recorded on Sunday represented slightly more than two percent of the $171 billion worth of assets under its management.
The exchange also confirmed that withdrawals involving more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, had resumed, while additional services and affected cryptocurrency networks would be restored in phases after the completion of security checks.
The reopening followed an earlier announcement by the company that it would adopt a gradual approach to restoring withdrawals, prioritising cryptocurrency networks and assets according to user demand and the outcome of security assessments.
In a bid to reassure customers over the safety of their investments, Binance said it had replaced approximately 95 percent of the cryptocurrency assets stolen during the attack, while the remaining five percent could take longer to source because of liquidity constraints.
The company has repeatedly pledged to absorb the entire financial impact of the breach, assuring customers that they would not be required to bear the losses arising from the cyberattack.
Last week, Binance announced that it had reserved more than $6.34 billion in company funds to address the consequences of the incident. It said the replacement of customers’ assets was being financed through a combination of resources, including its corporate treasury, futures insurance funds and emergency reserves.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident”, the company said.
The exchange said its priority was to restore normal operations while ensuring that all affected cryptocurrency networks and asset pairs met the required security and stability standards before withdrawals were fully reopened.
The latest figures on customer withdrawals and deposits provide an indication of the volume of transactions processed during the first day of the phased reopening.
Binance maintained that the initial surge in withdrawals had eased and that the situation was stabilising as expected.
Binance has also disclosed that preliminary investigations into the breach suggest that the attack may have originated from a compromised laptop belonging to one of its engineers.
The company said early checks indicated that hackers might have gained access to its systems through the device, subsequently exploiting the access to facilitate unathorised transactions.
However, the exchange has not published a complete technical account of how the alleged compromise occurred or how the attackers were able to execute transactions involving such a substantial volume of digital assets.
The breach affected Binance’s global centralised exchange, Binance.com, while its United States-facing platform was not affected by the incident.
Following the discovery of the attack, Binance suspended transactions and commenced security checks to contain the breach, protect customers’ assets and prevent further unauthorised transfers.
The company also began working with law enforcement agencies, blockchain intelligence firms, cryptocurrency issuers and other industry stakeholders to trace the stolen assets and facilitate their recovery. It said investigations were continuing alongside efforts to strengthen internal security controls and restore affected services.
Meanwhile, the United States Federal Bureau of Investigation (FBI) has accused North Korea of orchestrating the attack, identifying a Pyongyang-linked cybercriminal group known as TraderTraitor as responsible.
The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026.
“The Federal Bureau of Investigation (FBI) is releasing information advising that the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance”, the agency said.
The FBI also published a list of cryptocurrency wallet addresses associated with the group and urged cryptocurrency exchanges, financial technology companies and other private-sector organisations to block transactions involving the identified addresses.
According to the agency, investigators had observed TraderTraitor operatives converting the stolen assets into Ethereum, with further laundering expected through decentralised finance platforms and instant cryptocurrency swap services.
The FBI warned that the conversion and movement of the stolen assets through multiple cryptocurrency platforms could make it more difficult to trace and recover the funds. It therefore called on industry participants to identify and block transactions involving funds directly or indirectly connected to the wallet addresses associated with the hackers.
Following the FBI’s announcement, Binance said it had intensified efforts to work with cryptocurrency issuers and other industry partners to freeze affected assets and prevent the hackers from moving the stolen funds.
The identification of TraderTraitor confirmed earlier suspicions by private cybersecurity investigators and blockchain analysts that the attack was connected to North Korean-linked cybercriminal operations.
The group has also been blamed for the theft of $1.5 billion from cryptocurrency exchange Bybit in February 2025, which was then regarded as the largest cryptocurrency heist in history.
TraderTraitor is believed to be associated with the notorious Lazarus Group, a hacking organisation linked by the United States and other Western governments to several high-profile cyberattacks and cryptocurrency thefts.
The group gained international notoriety in 2014 when it was accused of hacking Sony Pictures Entertainment following the production of The Interview, a comedy film depicting a fictional assassination plot against North Korean leader Kim Jong Un.
Since then, the Lazarus Group has been linked to cyberattacks targeting financial leged involvement in the $1.5 billion Bf North Korean-linked cybercriminal networks to target digital financial platforms.
North Korea faces extensive international sanctions over its nuclear weapons and ballistic missile programmes and has repeatedly been accused of using cyber operations to generate revenue and circumvent restrictions on its access to the international financial system.
Cryptocurrencies are digital assets traded through online platforms such as Binance. Unlike conventional physical currencies, they exist electronically and are transferred and stored through I’m digital wallets and blockchain networks.
Binance, which was founded in China, has grown into the world’s largest cryptocurrency exchange by daily trading volume, with hundreds of millions of registered users globally.
The October 29 breach has forced the company to suspend transactions, mobilise billions of dollars in replacement assets and work with international authorities to trace the stolen funds.
Although withdrawals have resumed, Binance said the restoration of all affected services would remain gradual, with additional cryptocurrency networks and asset pairs reopening only after the completion of necessary security checks.
