Binance says withdrawals stabilise after $6.3 billion cryptocurrency heist

Binance says customer withdrawals have stabilised and it has replenished most of the cryptocurrency stolen in a $6.3 billion cyberattack, as the world’s largest cryptocurrency exchange tries to restore confidence after what could be the biggest digital-asset theft on record.

Richard Teng, Binance’s co-chief executive, said on Tuesday that the company was in “very strong financial health” and that deposits and withdrawals had largely returned to normal.

Speaking at Hong Kong Fintech Week, Teng said the exchange had replenished around 95% of the affected tokens using its Secure Asset Fund for Users (SAFU) and other company resources. The remaining 5% largely consisted of less-liquid tokens the company was working to acquire through over-the-counter providers.

“It’s a painful lesson. We take responsibility for it,” Teng said, adding that the company would publish a detailed post-mortem of the incident.

The comments came days after the Federal Bureau of Investigation attributed the October 29 theft to TraderTraitor, a North Korean state-sponsored hacking group. North Korea has rejected the allegation, describing Washington’s claims as “absurd rhetoric”.

Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, accused the United States of attempting to portray the country as a cybercrime state, according to North Korean state media.

The FBI said the hackers stole more than $6 billion in cryptocurrency from Binance. Blockchain records show that most of the theft occurred within approximately 20 minutes, beginning shortly after 8 PM GMT on October 29.

The incident affected digital assets across 10 blockchain networks and is potentially the largest cryptocurrency theft recorded.

How the attack unfolded

The attackers exploited vulnerabilities in Binance’s wallet infrastructure to gain unauthorised control over cryptocurrency transactions.

According to the Associated Press, investigators and blockchain security researchers have examined how the attackers compromised an internet-connected hot wallet, which is used to facilitate transactions and withdrawals.

Unlike offline cold wallets, hot wallets remain connected to the internet and are therefore more exposed to cyber threats.

The attackers moved the stolen assets across multiple blockchain networks in a short period, complicating efforts to trace and recover the funds.

Blockchain intelligence firms TRM Labs and Chainalysis have linked the attack to TraderTraitor, citing similarities with previous operations attributed to the group.

The FBI’s attribution has added to scrutiny of North Korea’s alleged involvement in cryptocurrency thefts. However, Pyongyang has consistently denied accusations linking it to international cyberattacks.

The exchange temporarily suspended withdrawals following the breach while it investigated the incident and reviewed its security arrangements. Withdrawals resumed in phases on November 1, with additional assets becoming available on Tuesday.

Customers withdraw billions

The breach triggered a substantial outflow of funds as customers moved their assets away from the exchange.

Binance reported net withdrawals of $4.72 billion by Monday, equivalent to around 3% of the assets held on its platform.

The figure represents the difference between customer withdrawals and deposits, rather than the total value of transactions made during the period.

The exchange said the pace of withdrawals had subsequently stabilised, with hourly inflows and outflows returning to more normal levels.

Binance also launched a customer appreciation campaign offering trading-fee rebates and other incentives to encourage users to continue trading on the platform. The campaign, scheduled to run until November 21, includes rewards for eligible users and promotional returns on selected yield-generating products.

The exchange has pledged to absorb the financial losses rather than pass them on to customers. Its SAFU emergency reserve, established to protect users in exceptional circumstances, is among the resources being used to cover the affected assets.

Binance also said it had worked with law enforcement agencies, blockchain intelligence firms and other cryptocurrency companies to freeze assets linked to the attack.

The Associated Press previously reported that approximately $3 billion in stolen assets were frozen through cooperation with industry partners. However, freezing cryptocurrency does not necessarily mean that all affected funds have been recovered.

Binance, which says it has more than 335 million registered users worldwide, has faced renewed questions about the security of its systems and the safeguards used to authorise large transactions.

North Korea and cryptocurrency thefts

The FBI’s attribution to TraderTraitor places the Binance incident within a wider pattern of cryptocurrency thefts linked to North Korean state-sponsored hacking operations.

The group has been associated with several major attacks against cryptocurrency exchanges and blockchain-related businesses.

In February 2025, hackers stole approximately $1.5 billion from Dubai-based cryptocurrency exchange Bybit. The FBI also attributed that attack to North Korea.

Cybersecurity researchers say cryptocurrency theft has become an important source of illicit revenue for North Korea, which faces extensive international sanctions over its nuclear and ballistic missile programmes.

Blockchain analytics firm Elliptic estimates that North Korea has stolen cryptocurrency worth $7.6 billion in 2026, more than in any previous year. Chainalysis has also identified North Korean-linked groups as responsible for a substantial share of cryptocurrency thefts.

The Binance breach has renewed concerns about the security of centralised exchanges, which hold large quantities of digital assets and rely on interconnected systems to process transactions.

Although Binance says it has restored most of the affected assets and customer withdrawals have stabilised, the incident has raised questions about the safeguards needed to protect digital assets from increasingly sophisticated attacks.

The exchange’s promised post-mortem is expected to provide further details about how the attackers gained access, how transactions were authorised and what changes will be made to prevent similar breaches.