Binance says it has covered about 95% of stolen assets
Binance customers withdrew about $3.6 billion (£2.7 billion) in digital assets as the world’s biggest cryptocurrency exchange reopened Sunday following a hack that affected $6.3 billion, according to figures the company posted on X. BBC News described the incident as what was believed to be the largest hack in history.
The firm suspended all transactions in the wake of the incident, which impacted $6.3 billion worth of digital assets. Binance also said withdrawals of more than two dozen major cryptocurrencies like Bitcoin and Ethereum have resumed and that more services will resume in phases once security checks are completed.
Binance reported the net movement from 06:00 to 15:30 GMT on November 1. It said on X: “Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion.” The company said there had been an “initial spike” in withdrawals, which later declined and stabilised as expected.
Sunday’s net withdrawals accounted for just over 2% of the $171 billion in assets under Binance’s management, the company said. Binance said last week it had reserved more than $6.3 billion in funds to deal with the fallout of the attack.
Binance said it has covered around 95% of the assets stolen in the breach, though the remaining amount may take longer to source. The exchange has repeatedly said it would cover all losses linked to the attack.
Binance said it had replaced customers’ assets using a combination of sources, including its corporate treasury, futures insurance and emergency reserve funds. It said: “Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident.”
Major organizations, including the US Federal Bureau of Investigation (FBI), accused North Korea of responsibility for the cyberattack. BBC News reported that the attack had been attributed to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. The report said the group had stolen a then-record $1.5 billion from crypto exchange Bybit in 2025.
On Saturday, the FBI published a list of cryptocurrency wallet addresses linked to the group and urged industry partners to help by blocking transactions involving them. Binance also urged cryptocurrency issuers to freeze affected assets.
Binance said last week that early checks suggested the incident may have started with a compromised laptop belonging to an engineer, allowing hackers to find a way to make unauthorized transactions.
The hack hit Binance’s global centralized exchange, Binance.com, while its US-facing platform said it had not been affected by the issue.
Binance was founded in China and has hundreds of millions of registered users globally. Cryptocurrencies are digital assets traded on exchanges such as Binance. Unlike cash, they do not exist in physical form and are managed on computers, smartphones and other digital devices.
Recovering the proceeds remained active. Alec Zebrick, senior manager in global services at Chainalysis, told the BBC’s Today Programme: “We continue to see funds being laundered quite actively.” He added: “The attackers are layering these funds across many thousands of addresses, across thousands of deposits.” Chainalysis has been working with Binance and governments to get the stolen money back.