For a few hours on Sunday morning, the world’s largest cryptocurrency exchange became a test of something harder to measure than money: trust.
Binance reopened its doors after suspending all transactions following what is believed to be the largest hack in history — a breach that touched $6.3bn worth of digital assets. When the platform came back online, customers did not hesitate. They ran.
The Numbers That Tell the Story
Between 06:00 and 15:30 GMT on November 1, Binance processed $4.649 billion in withdrawals against $1.01 billion in deposits — a net outflow of roughly $3.64 billion.
The exchange described an “initial spike” in withdrawals that later declined and was “stabilising as expected.” Those net withdrawals amount to just over 2% of the $171bn in assets under its management.
Binance said last week it had reserved more than $6.3bn in funds to absorb the fallout. The company has covered around 95% of the stolen assets so far, though the remainder may take longer to source. It has repeatedly committed to covering all losses tied to the attack.
Withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, with more services to follow in phases once security checks are completed.
The Finger Points East
Major organisations, including the FBI, have accused North Korea of responsibility for the cyber-attack, attributing it to TraderTraitor — a North Korean cybercrime group also known as the Lazarus Group, which stole a then-record $1.5bn from crypto exchange Bybit in 2025.
The FBI on Saturday published a list of cryptocurrency wallet addresses linked to the group and urged industry partners to block transactions involving them. Binance, in turn, scrambled to urge crypto issuers to freeze affected assets.
The Money Is Still Moving
The stolen funds are not sitting still. According to Alec Zebrick, senior manager in global services at Chainalysis, which has been working with Binance and governments to recover the money, the laundering is ongoing and active.
He told the BBC’s Today Programme that the attackers are spreading the funds across many thousands of addresses and thousands of deposits — layering the money to obscure its trail.
A Laptop, an Engineer, a Breach
Binance said last week that early checks suggest the incident may have started with a compromised laptop belonging to an engineer, giving hackers a route to make unauthorised transactions.
The hack struck Binance’s global centralised exchange, Binance.com. Its US-facing platform said it was not affected.
To make customers whole, Binance said it drew on a combination of sources: its corporate treasury, its futures insurance fund and its emergency reserve.
Did You Miss? Trump’s Final Midterm Push and the 2026 US Midterm Elections
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the firm said.
What Is Actually at Stake
Cryptocurrencies are digital assets traded on exchanges such as Binance. Unlike cash, they have no physical form — they exist only on computers, smartphones and other devices. That is precisely what makes a breach like this so consequential: there is no vault to inspect, no branch to visit, only code and confidence.
Binance was founded in China and has hundreds of millions of registered users globally.
On Sunday, those users made their feelings known — not in statements, but in withdrawals. The exchange has promised to make them whole. The harder task, now underway, is convincing them to stay.