Binance, the world’s largest cryptocurrency exchange, says customer withdrawals are beginning to stabilise following a massive security breach that resulted in the theft of approximately $6.3 billion in digital assets.
The company is gradually restoring its services after temporarily suspending withdrawals in response to the attack, which triggered concern among investors and raised fresh questions about the security of major cryptocurrency platforms.
According to Binance, customers withdrew a net $3.64 billion after the incident, representing approximately 2.1 per cent of the exchange’s assets. Despite the substantial withdrawals, the company said deposits had remained significant, suggesting that some customers continued to use the platform.
The development is an important early test of confidence in Binance following what analysts have described as potentially the largest cryptocurrency theft on record.
Binance says most stolen assets have been replaced
Binance has moved to reassure customers that it has the financial resources to cover the losses arising from the attack.
The exchange said it had replaced approximately 95 per cent of the stolen cryptocurrency using company funds and other financial reserves. It estimated that the remaining five per cent would take longer to recover because the affected tokens were less liquid and more difficult to purchase in the required quantities.
The company had previously announced that it was using approximately $6 billion to acquire replacement assets for customers.
Binance also said its total assets under management stood at approximately $171 billion as of October 28, 2026.
The exchange has repeatedly maintained that customers should not bear the financial consequences of the breach, pledging to cover the losses through its own resources.
However, the scale of the incident has placed the company’s security arrangements and ability to protect customer holdings under renewed scrutiny.
Withdrawals resume in phases
The restoration of withdrawal services is being carried out gradually, with Binance prioritising digital currencies according to customer demand.
The first phase covered 15 tokens, including Bitcoin, Ether, selected USDC and USDT-related assets, and Dogecoin.
The company explained that the phased approach was intended to manage the process while ensuring that users could gradually regain access to their funds.
Although Binance said withdrawals were becoming more stable, the amount of money leaving the platform remained an important indicator of customer confidence.
Blockchain analytics platform DefiLlama reported higher outflows than Binance’s own figures. Its dashboard initially showed withdrawals exceeding $4 billion before the estimate increased to approximately $5.81 billion.
Binance disputed the accuracy of the initial figures, arguing that certain movements involving funds transferred into its newly established hot wallet had not been properly reflected.
The difference between the figures highlights the difficulty of measuring cryptocurrency movements during a major security incident, particularly when deposits, withdrawals and internal wallet transfers are happening simultaneously.
FBI links attack to North Korean hacking group
The Federal Bureau of Investigation (FBI) has attributed the attack to TraderTraitor, a cyber unit associated with North Korea.
According to the agency, investigators observed members of the group converting stolen digital assets into Ether. The FBI also warned that further laundering activities could follow as the perpetrators attempt to conceal the movement of the funds.
Blockchain intelligence companies TRM Labs and Chainalysis had also pointed to possible North Korean involvement, citing similarities between the Binance incident and previous cryptocurrency thefts linked to the group.
The bulk of the attack reportedly unfolded in approximately 20 minutes, with billions of dollars moved from Binance-controlled wallets.
However, US President Donald Trump said it was not yet clear whether North Korea was responsible, despite the FBI’s attribution.
North Korea has repeatedly denied allegations that state-linked groups are involved in cybercrime and cryptocurrency theft.
The investigation remains important because identifying the attackers could help authorities and private-sector partners trace the stolen funds and pursue those responsible.
Crypto markets feel the impact
The Binance breach also unsettled the wider cryptocurrency market, with investors reacting to concerns about the safety of digital assets held on centralised exchanges.
Bitcoin fell to a six-week low on Friday before recovering somewhat over the weekend. It was trading above $78,000 on Monday, while Ether also recovered after reaching a two-month low.
The incident contributed to wider market pressure, including a decline of approximately $1.2 billion in the combined market capitalisation of the two largest stablecoins, USDT and USDC.
Spot Bitcoin exchange-traded funds recorded $643 million in withdrawals on Friday, their largest single-day outflow in October, according to figures cited by Reuters.
More than $1.3 billion in leveraged cryptocurrency positions were also liquidated, adding to the pressure on digital asset prices.
Market analysts warned that the breach could make institutional investors more cautious about keeping large amounts of cryptocurrency on centralised trading platforms.
For investors managing funds on behalf of clients, the incident has renewed concerns about the risks associated with relying on a single exchange.
Investors urged to review cryptocurrency storage
The scale of the theft has prompted renewed discussions about how individuals and institutions store digital assets.
Jay Koh, vice president of the Asia Web3 AI Association, said investors should consider reviewing their exposure and spreading their holdings across different custody arrangements.
He explained that keeping most of his cryptocurrency in a cold wallet had helped limit his exposure to the Binance incident.
Cold wallets store private keys offline, reducing their exposure to certain internet-based attacks. Hot wallets, by contrast, remain connected to the internet and are commonly used by exchanges to facilitate deposits and withdrawals.
Security specialists generally recommend that investors understand the risks associated with each storage method rather than relying entirely on a single platform.
The Binance incident has demonstrated how quickly a security failure can affect an exchange and trigger billions of dollars in withdrawals.
A major test for the cryptocurrency industry
Binance has approximately 335 million registered users worldwide, making the incident particularly significant for the global cryptocurrency market.
The exchange’s ability to replace most of the stolen assets and restore withdrawal services could help prevent a deeper loss of confidence. Nevertheless, customers and regulators are likely to pay close attention to the findings of the ongoing investigation.
The breach also adds to a growing list of major cryptocurrency thefts. Researchers at TRM Labs estimated that attackers stole approximately $2.9 billion in digital assets across nearly 150 incidents in 2025.
For Binance, the immediate challenge is to demonstrate that its security systems have been strengthened and that customers can continue using the platform with confidence.
For the wider industry, the incident is another warning that even the largest cryptocurrency businesses remain exposed to sophisticated cyberattacks.
Although withdrawals are stabilising, the longer-term impact will depend on the investigation, the recovery of outstanding assets and Binance’s ability to convince users that their funds are adequately protected.
