Binance customers withdrew $3.64 billion, or 2.1% of the exchange’s assets, as the world’s largest cryptocurrency exchange resumed service following a security breach. About $6.3 billion was stolen from the platform last week.
The exchange said withdrawals were stabilising after an initial spike, and that deposit volumes had remained “substantial.” Analysts believe the theft may be the largest financial robbery in history.
Crypto prices and outflows after the breach
Bitcoin hit a six-week low on Friday but recovered slightly over the weekend, trading above $78,000 on Monday. Ether fell to a two-month low on Friday before also recovering a little, to $2,287.
Binance, which lets users buy, sell and trade digital assets, has 335 million registered users worldwide. It said on Sunday that it had $171 billion in total assets under management as of October 28.
Stablecoin market capitalisations tend to fall when money leaves cryptocurrencies, and they have dropped since Friday. According to Coinmarketcap.com, the combined capitalisation of the two largest stablecoins, USDT and USDC, has fallen by about $1.2 billion since Friday.
Ari Redbord, global head of policy at the US blockchain analysis firm TRM Labs, said spot bitcoin ETFs shed $643 million on Friday, the largest daily outflow of October. He also said more than $1.3 billion in leveraged positions were liquidated.
Redbord said conservative institutional investors would find the situation unsettling. “A hack at a financial institution means stolen usernames and passwords,” he said. “A hack at a crypto exchange is bank robbery at the speed of the internet.”
Binance covers stolen assets and blames North Korean unit
Binance said on Sunday that it had covered $6 billion of the stolen cryptocurrencies by using its own money to buy replacement tokens. It said the remaining 5% consists of less liquid assets that may take longer to source. In total, the exchange said it had covered 95% of the stolen assets.
The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored unit, was responsible for the attack. Pyongyang has for years denied using state-linked cyber units for espionage, financial theft and revenue generation. Its mission in Geneva and its embassy in China did not respond to requests for comment.
In a statement, the FBI said law enforcement had seen members of the unit converting stolen assets into the cryptocurrency ether. It said it expected “further laundering” of the assets using related technology.
Analysts had also pointed to North Korea. According to the US blockchain analysis firms TRM Labs and Chainalysis, most of the theft unfolded in around 20 minutes beginning late on Thursday, and it resembled previous large attacks blamed on North Korea. US President Donald Trump later said on Saturday that it remained unclear whether North Korea was involved.
“We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it,” Trump told reporters, in comments posted by a White House account on X.
Phased withdrawals and user caution
Binance said the withdrawal rollout would be carried out in stages, with priority given to user demand. The first phase covered 15 tokens, including bitcoin, ether, dogecoin and some tokens involving USDC and USDT stablecoins.
The exchange said it was prioritising tokens based on the past week of user demand. In an earlier post on X, Binance said, “Rest assured that market conditions are stable.” It also said its net outflows reflected what clients had withdrawn and deposited after the event.
Crypto analytics platform DefiLlama said on its dashboard that outflows were higher, at $5.81 billion, up from the $4.36 billion it had shown earlier. Binance did not immediately respond to a request for comment on the updated figures.
A Binance spokesperson said the initial DefiLlama data did not account for flows to the exchange’s own new hot wallet, so it was not accurate. The spokesperson said the exchange’s last update on X was closest to accurate, once moves in deposits and withdrawals since it was posted were taken into account.
Some users were weighing ways to hedge their risks. Jay Koh, vice president at the Asia Web3 AI Association, said he had not withdrawn any of his holdings from Binance, because most of his funds were held in a cold wallet that the hack did not affect. He said he would not necessarily withdraw everything, but that it was prudent to review exposure, diversify custody arrangements and avoid keeping more assets on any single platform than necessary.
