Binance sees $3.64 billion exit in 9.5 hours as withdrawals reopen after $6.3 billion hack

Binance customers withdrew $4.649 billion in the first 9.5 hours after the exchange began reopening withdrawals on November 1, 2026, leaving a net outflow of about $3.64 billion, or 2.1% of its assets, Binance said on X. The exchange is restoring service in phases after a $6.3 billion hack that the FBI attributes to North Korea’s TraderTraitor group.

In its update, Binance reported that it was restoring access to affected assets and networks in stages, using customer demand data from the preceding week to determine priorities.

“Between 6.00am and 3.30pm UTC on 1 November, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion,” Binance said.

The company said it was taking a phased approach to reopening its services, prioritising cryptocurrencies according to recent user demand while conducting security checks on individual networks and trading pairs.

The initial reopening covered approximately two dozen major cryptocurrencies, including Bitcoin and Ethereum. Binance said other assets would become available as technical assessments and security checks were completed.

For Binance users, the resumption of withdrawals offered a way to regain access to funds held on the platform. However, the substantial outflows also highlighted the immediate movement of capital following the incident.

Binance users await recovery of stolen cryptocurrencies

The exchange said it had recovered approximately 95% of the cryptocurrency stolen during the October 29 attack, although its recovery efforts remained ongoing.

According to Binance, the original theft involved approximately $6.3 billion in digital assets. The company said recovering the remaining 5% could take longer because the outstanding assets were less liquid and therefore more difficult to source.

The recovery announcement came after the exchange temporarily suspended withdrawals for 48 hours while its teams worked to contain the incident, assess the damage and restore affected services.

Binance described the suspension as a precautionary measure intended to prevent further losses while investigations and technical checks were underway.

“Our priority was to protect users, safeguard the platform, and complete the necessary security checks before restoring services,” the company said.

The exchange also pledged to absorb the financial impact of the stolen funds rather than transfer the losses to customers.

That commitment is significant for Binance users concerned about whether the attack could affect their account balances or the availability of their assets. The company said it would cover the losses using its own funds, while the recovery operation continued.

However, the reported recovery of 95% of the stolen cryptocurrency does not necessarily mean that all affected systems have been fully restored or that every outstanding asset has been returned to its original location. Binance said it was continuing to test the remaining networks and assets before reopening access.

The company also reported that withdrawal volumes had declined after an initial surge, while deposits remained substantial.

“After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial,” Binance said.

The exchange added that its technical teams were continuing rigorous testing of the remaining networks and assets.

Although the company characterised the changing withdrawal pattern as expected, it did not establish that the initial outflows reflected a broader loss of confidence among customers. The figures instead show the net movement of funds during a specific period after withdrawals resumed.

FBI links Binance hack to North Korea’s TraderTraitor

The investigation into the attack took a significant turn on Saturday, October 31, when the Federal Bureau of Investigation attributed the theft to North Korea’s state-sponsored hacking network, known as TraderTraitor.

In a public statement, the US agency said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or around October 29, 2026.

“The Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance on or about 29 October 2026,” the FBI said.

The agency identified the operation as part of its tracking of malicious cyber activity associated with TraderTraitor, a hacking network linked to North Korea.

According to the FBI, members of the network were observed converting the stolen assets into Ethereum following the attack. The agency warned that further laundering of the cryptocurrency was expected.

The conversion of stolen digital assets into other cryptocurrencies can complicate efforts to trace and recover funds, particularly when transactions move across multiple blockchain networks or involve services that obscure the origin of funds.

In this case, the FBI’s attribution provides an official assessment of who was responsible for the attack, while its warning about further laundering suggests that tracking the stolen assets remains an active concern.

The incident also underscores the challenges cryptocurrency exchanges face when responding to major security breaches. Even when an exchange can suspend services and commit its own resources to covering losses, investigators may still need to trace assets across blockchain networks to establish where the stolen funds have gone.

Binance users face a phased return to normal operations

Binance’s reopening on November 1 marked an important step towards restoring normal operations, but the exchange’s phased approach meant that access to all affected networks and assets was not necessarily available immediately.

The company said it was prioritising assets based on recent customer demand and would reopen additional services only after completing the required stability and security checks.

For Binance users, the immediate priorities are access to their funds, the restoration of affected services and clarity about the company’s response to the breach.

The reported $3.64 billion net outflow during the first nine and a half hours of resumed withdrawals demonstrates the scale of financial movement that followed the reopening. At the same time, the $1.01 billion in deposits recorded during the period indicates that funds continued to enter the exchange.

Those figures alone do not establish whether customer confidence has recovered or whether further withdrawals will follow. A more complete assessment will depend on subsequent withdrawal and deposit activity, the restoration of remaining services and the progress of investigations into the stolen assets.

Binance has maintained that it will absorb the financial losses associated with the theft, while its technical teams continue restoring access to affected assets and networks.

Meanwhile, the FBI’s attribution of the attack to North Korea’s TraderTraitor network adds an international law enforcement dimension to the incident, particularly as investigators anticipate further attempts to move or launder the stolen cryptocurrency.

The coming days will be important in determining how quickly the exchange can complete its recovery process, whether the remaining stolen assets can be traced and how customer activity develops as services return.

For now, Binance has resumed withdrawals, reported recovering approximately 95% of the stolen cryptocurrency and pledged to cover the financial impact of the breach. The exchange’s next challenge is to complete the restoration of its services while demonstrating that the security measures introduced after the attack are sufficient to protect customer assets.