Global crypto giant Binance faced a massive rush of withdrawals as soon as it resumed services on Sunday, following a record-breaking cyber attack last week. The firm had paused all platform transactions after the breach affected digital assets valued at $6.3bn.
Between 06:00 and 15:30 GMT on November 1, the exchange reported handling $4.649 billion in withdrawals against $1.01 billion in deposits, leading to a net outflow of roughly $3.64 billion. Binance shared on X that the early spike in transactions eventually dropped and began stabilising.
North Korean group blamed for breach
Key international agencies, including the US Federal Bureau of Investigation (FBI), pointed fingers at North Korea for executing what is described as the largest hack in history. The cyber attack was blamed on TraderTraitor, a North Korean cybercrime syndicate also referred to as Lazarus Group.
The same group reportedly made away with $1.5bn from digital platform Bybit back in 2025. On Saturday, the FBI made public a list of crypto wallets tied to this network, calling on industry partners to freeze any incoming or outgoing transfers.
“Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion,”Binance
Laptop issue and fund recovery
According to preliminary checks by Binance, the entire crisis may have begun through an engineer's compromised laptop, which opened the door for criminals to trigger illicit transfers. The issue struck the global platform Binance.com, whereas its US-facing platform confirmed it remained safe.
Binance, which stated in 2024 that it held over $160bn in assets, reassured traders that it had already recovered around 95% of stolen customer holdings. The exchange tapped into its treasury, futures insurance, and emergency reserve funds, allocating more than $6.34bn to address the damage.
What happens next
More services will resume in phases once security checks are completed.
