Binance Resumes Crypto Withdrawals After $6.3 Billion Hack as Customers Pull Out Funds

NEW DELHI, Nov 2: Cryptocurrency exchange Binance has begun restoring withdrawal services following a massive security breach involving approximately USD 6.3 billion in digital assets, as the company works to reassure customers and strengthen confidence in its platform.

The world’s largest cryptocurrency exchange resumed withdrawals of Bitcoin, Ether and selected stablecoins on Sunday through a phased restoration process. The decision came after Binance said it had replaced approximately 95 per cent of the stolen cryptocurrency using its own financial resources.

The incident, which has been linked by the United States Federal Bureau of Investigation (FBI) to a North Korean state-sponsored hacking group, has raised fresh questions about cybersecurity standards across the global cryptocurrency industry.

The attack also triggered a significant movement of funds from the exchange, with customers withdrawing approximately USD 3.64 billion, equivalent to 2.1 per cent of Binance’s assets, after withdrawal services became available again.

Binance said the initial surge in withdrawals had started to stabilise and that deposit activity remained substantial. The figures are being closely monitored by the industry because customer behaviour following a major security incident provides an indication of whether users continue to trust an exchange with their digital assets.

The company said the first stage of its withdrawal restoration covered 15 cryptocurrencies, including Bitcoin, Ether, XRP, Dogecoin and selected USDC and USDT stablecoins.

Withdrawals were restored in stages, with the exchange prioritising assets according to recent customer demand. Bitcoin withdrawals resumed shortly after 0600 GMT on Sunday, followed by additional supported cryptocurrencies.

Binance said the phased arrangement was necessary to manage the restoration process while ensuring that security checks could be completed. The company indicated that further services would be brought back as its technical teams assessed the situation.

The breach had initially forced Binance to temporarily suspend deposits and withdrawals while investigators examined the incident, worked with law enforcement agencies and attempted to identify and freeze affected assets.

In an earlier update, Binance said its investigation suggested that the attack may have involved a compromised laptop belonging to a DevOps engineer. According to the company’s preliminary assessment, the attacker potentially used access obtained through the device to enter a service container and submit unauthorised withdrawal transactions.

The exchange said it had found no evidence that private keys associated with its cryptocurrency wallets had been leaked.

Binance also indicated that the incident involved sophisticated malicious software designed to remove evidence of its activity, making the investigation more complicated. The company said it would provide additional technical information once the relevant findings had been verified.

The estimated financial impact of the incident has made it one of the most significant reported security events in the cryptocurrency sector.

Binance said it had already replaced approximately USD 6 billion worth of stolen cryptocurrency by purchasing equivalent assets through company funds. The remaining five per cent consisted of less liquid digital assets that could take additional time to obtain in the required quantities.

The exchange has maintained that it will bear the financial consequences of the breach rather than pass the losses on to customers.

To meet the replacement requirement, Binance has drawn on several financial resources, including its Secure Asset Fund for Users (SAFU), Futures Insurance Fund and corporate treasury.

SAFU is a reserve established by Binance to provide additional protection to customers in the event of security-related incidents. The fund was previously valued at approximately USD 1 billion.

Co-CEO Yi He said the company would use half of the SAFU reserve as part of its response, while committing to replenish the fund to approximately USD 1 billion.

Binance has also worked with other cryptocurrency companies and blockchain partners to trace and freeze assets connected to the incident. The exchange previously reported that approximately USD 3 billion in affected funds had been located through these efforts.

The FBI announced on Saturday that the North Korean state-sponsored cyber group known as TraderTraitor was responsible for the attack.

According to the agency, investigators observed members of the group converting stolen cryptocurrency into Ether and expected further attempts to move the funds through additional transactions and laundering methods.

The FBI’s assessment has added an international dimension to the incident, as North Korean-linked cyber operations have previously been associated with cryptocurrency thefts and other financial cyberattacks.

However, US President Donald Trump said on Saturday that the involvement of North Korea had not been conclusively established from his perspective. He indicated that Washington would seek discussions with Pyongyang if the country’s involvement was confirmed.

North Korea has repeatedly denied accusations that state-linked cyber units are involved in criminal financial activities.

The rapid movement of cryptocurrency following the Binance breach has also attracted attention from blockchain analytics companies. Reuters reported that the bulk of the theft occurred within approximately 20 minutes late on Thursday, according to assessments by US blockchain analysis firms.

The scale and speed of the incident have renewed concerns about the vulnerabilities of centralised cryptocurrency exchanges, which manage large quantities of digital assets and process transactions across multiple blockchain networks.

Unlike traditional financial institutions, cryptocurrency platforms operate in an environment where transactions can be transferred across international networks within minutes. Although blockchain records provide a permanent transaction history, identifying the individuals controlling digital wallets can be difficult.

The incident has also demonstrated the importance of securing internal systems and employee devices. A compromised workstation can potentially provide attackers with access to wider corporate infrastructure if access controls, authentication procedures and network protections are inadequate.

Binance’s preliminary explanation involving a compromised employee laptop has therefore placed additional attention on internal cybersecurity practices. Companies handling digital assets are increasingly expected to protect not only their cryptocurrency wallets but also the software, employees and operational systems connected to those wallets.

The response from stablecoin issuers has provided another example of how different participants in the cryptocurrency ecosystem can cooperate during a major security incident.

Tether and Circle announced that they had frozen funds associated with the breach. Tether CEO Paolo Ardoino said the company had frozen more than USD 1.5 billion in related assets, while Circle CEO Jeremy Allaire reported freezing more than USD 800 million in currency in coordination with law enforcement.

Such interventions can prevent certain digital assets from being moved or converted, although the ability to freeze funds depends on the structure and control mechanisms of the particular cryptocurrency.

The incident has also affected sentiment in the broader digital asset market. Bitcoin declined by approximately 3.2 per cent on Thursday evening, falling below USD 79,000 as concerns surrounding the security breach weighed on investor confidence.

The withdrawal figures released after Binance restored services have become an important measure of the market’s response. The exchange reported net outflows of USD 3.64 billion based on customer deposits and withdrawals recorded up to 1530 GMT on Sunday.

However, independent cryptocurrency analytics platform DefiLlama reported a higher outflow figure of USD 5.81 billion. Binance disputed the accuracy of the larger estimate, saying the calculation did not include certain transfers into its newly established hot wallet.

The difference highlights the difficulties involved in measuring cryptocurrency movements during periods of extraordinary activity, particularly when exchanges are moving their own reserves while customers are also making transactions.

Binance said it had approximately 335 million registered users worldwide and reported total assets under management of USD 171 billion as of October 28.

Given its international presence, the incident has implications extending beyond a single trading platform. Cryptocurrency exchanges play a central role in providing access to digital assets, and major disruptions can influence investor confidence, market liquidity and the willingness of customers to keep funds on centralised platforms.

The attack has also intensified discussions about the need for stronger cooperation between exchanges, blockchain analytics firms, financial regulators and law enforcement agencies.

Cybersecurity specialists have repeatedly highlighted the importance of independent security audits, strict employee access controls, multi-layer authentication, transaction monitoring and effective incident-response procedures.

For cryptocurrency businesses, maintaining secure infrastructure has become an essential part of protecting their commercial reputation. Even when a company promises to reimburse affected users, a serious breach can create uncertainty about its operational resilience.

Binance founder Changpeng Zhao thanked US law enforcement agencies for their assistance in tracking and freezing the stolen assets. He also expressed confidence that customer funds would be covered, although he said he no longer manages the exchange.

The company has continued to emphasise that it will absorb the financial impact of the incident and complete the process of replacing the stolen assets.

Nevertheless, restoring withdrawal services does not automatically resolve all concerns arising from the attack. Customers and industry observers will continue to examine the company’s investigation findings, the effectiveness of its security improvements and its ability to prevent similar incidents.

The latest breach has once again exposed the risks associated with digital asset platforms, where large financial holdings and complex technological infrastructure create attractive targets for sophisticated cybercriminal groups.

As cryptocurrency adoption expands internationally, exchanges will face increasing pressure to demonstrate that their systems can withstand attacks while ensuring the safety and accessibility of customer funds.

For Binance, the immediate priority is to complete the phased restoration process, account for the remaining stolen assets and rebuild customer confidence. The incident is also likely to serve as a warning to other digital asset companies about the importance of strengthening internal cybersecurity measures before vulnerabilities are exploited.