Binance has recorded $4.7 billion in net withdrawals since a major cyberattack drained approximately $6.4 billion in cryptocurrency from the world’s largest crypto exchange. The outflows followed the platform’s temporary suspension of customer withdrawals and have raised fresh questions about security, customer confidence and the resilience of centralized cryptocurrency exchanges.
The FBI has attributed the theft to North Korea, identifying the state-sponsored hacking group TraderTraitor as responsible. Binance has pledged to absorb the financial impact of the incident and says it has already replaced approximately 95% of the stolen assets. Although the withdrawal figure is substantial, it represents less than 4% of the exchange’s reported $128 billion in assets.
Binance Records $4.7 Billion in Net Outflows
Net withdrawals from Binance reached $4.7 billion by Monday morning in London, according to a company spokesperson cited by Bloomberg. The figure reflects the difference between assets leaving and entering the exchange, rather than the total value of customer withdrawal requests.
The outflows followed Binance’s decision to temporarily suspend withdrawals after detecting the security breach on Thursday evening. The exchange restored withdrawals on Sunday through a phased process as it worked to stabilize its systems and coordinate with industry partners.
Despite the large withdrawals, Binance said activity remained within its expectations and that deposits were steadily increasing. The company also emphasized that the outflows represented less than 4% of its reported $128 billion in assets.
| Key development | Reported figure |
|---|---|
| Cryptocurrency stolen | Approximately $6.4 billion |
| Net withdrawals reported by Binance | $4.7 billion |
| Binance assets cited in the report | $128 billion |
| Estimated share of assets withdrawn | Less than 4% |
| Stolen assets replaced by Sunday | Approximately 95% |
| Date of reported outflow figure | November 2, 2026 |
The figures show that the hack triggered significant withdrawals, but they do not indicate that Binance lost an equivalent amount of customer assets through the subsequent withdrawals. Net outflows measure the movement of funds from the exchange, while the stolen cryptocurrency represents the direct impact of the security breach.
FBI Attributes the Hack to North Korea
The FBI has linked the attack to TraderTraitor, a North Korean state-sponsored hacking unit. The group has previously been associated with major cryptocurrency thefts, including the $1.5 billion Bybit hack in February 2025.
Blockchain intelligence firms TRM Labs and Chainalysis also pointed to TraderTraitor, citing similarities with earlier attacks attributed to North Korean hackers. According to TRM Labs, approximately $6.36 billion was moved from Binance wallets across 10 blockchains, with most of the theft occurring within roughly 20 minutes.
The FBI said it had observed the attackers converting stolen assets into Ethereum and warned that further laundering could involve decentralized finance platforms and instant cryptocurrency swap services.
Binance initially said its investigation suggested that a compromised laptop may have been involved, but subsequent findings identified additional points of breach. The company has continued working with law enforcement agencies, blockchain analytics firms and cryptocurrency issuers to trace the stolen funds.
The attribution is significant because North Korean hacking groups have repeatedly targeted cryptocurrency platforms and digital asset infrastructure. However, identifying the suspected attackers does not automatically mean that all stolen assets can be recovered.
Binance Says It Has Replaced 95% of Stolen Assets
Binance has committed to covering the financial impact of the theft and has said customers will not bear the losses. By Sunday, the company reported that it had replaced approximately 95% of the stolen cryptocurrency.
The recovery effort involved company funds and cooperation with external industry partners. Binance also worked with token issuers and other organizations to freeze assets, with the Associated Press reporting that roughly $3 billion in affected assets had been frozen.
The exchange said it had reserved more than $6.34 billion in company funds to cover the stolen assets. Its response has involved several sources of financial support, including its Secure Asset Fund for Users, insurance-related reserves and corporate treasury resources.
The company’s commitment to reimburse affected users is intended to prevent the theft from directly translating into customer losses. However, replacing stolen tokens and recovering the original assets are different processes. Binance may need to purchase replacement cryptocurrency even when the stolen funds cannot be retrieved.
The remaining unreplaced assets could also be harder to source because of differences in liquidity and availability across cryptocurrency markets.
Why the $4.7 Billion Outflow Matters
Large withdrawals can put pressure on an exchange’s liquidity management and create uncertainty among traders. When customers move assets to private wallets or competing platforms, an exchange may face reduced balances and changes in trading activity.
However, withdrawals alone do not establish that an exchange is insolvent or unable to meet customer obligations. Binance’s reported outflows remain below 4% of its stated asset base, while the company says deposits have been increasing.
The distinction between customer withdrawals and internal transfers is also important. Binance co-CEO Yi He said some reported withdrawals involved transfers between Binance wallets rather than customers moving assets away from the platform.
For this reason, analysts are watching several indicators beyond the headline outflow number:
- Net flows: Whether deposits begin to offset withdrawals.
- Trading liquidity: Whether traders can continue buying and selling without significant disruption.
- Market depth: Whether large transactions can be executed without sharply affecting prices.
- Customer confidence: Whether users continue to hold and trade assets on Binance.
- Recovery progress: Whether the exchange can replace or recover the remaining stolen cryptocurrency.
The exchange’s ability to maintain normal trading conditions will be an important measure of how effectively it manages the aftermath of the attack.
Crypto Market Remains Relatively Stable
Despite the scale of the incident, the wider cryptocurrency market remained relatively steady on Monday. Bitcoin traded around $78,000, according to the Bloomberg report, while market participants assessed the potential impact on Binance and the broader digital asset industry.
The market response suggests that the incident had not immediately triggered widespread selling across major cryptocurrencies. However, price stability does not necessarily mean that investors have regained confidence in exchange security.
The attack also comes amid a wider increase in cybercrime targeting cryptocurrency companies and financial platforms. Recent incidents involving exchanges, digital wallets and hardware wallet infrastructure have highlighted the range of security risks facing the industry.
The Bybit attack in 2025 provides a relevant comparison. That incident involved approximately $1.5 billion in stolen cryptocurrency and was also attributed by the FBI to North Korea. Withdrawals initially increased before eventually stabilizing, according to industry participants cited in the Bloomberg report.
The Binance incident is considerably larger in reported dollar value, making its recovery and the response from customers important developments for the wider crypto sector.
The Bigger Picture
The Binance hack highlights a central challenge for the cryptocurrency industry: exchanges must protect large pools of digital assets while keeping trading and withdrawals accessible to millions of users. Even when most customer funds are not directly affected, a major breach can prompt withdrawals and raise questions about how exchanges manage private keys, hot wallets and internal approval systems.
The incident also demonstrates why exchange security cannot depend only on the promise to reimburse customers. Strong access controls, independent security reviews, transaction monitoring and transparent reporting are essential to maintaining trust. The ability to replace stolen assets may help contain immediate financial damage, but it does not eliminate the operational and reputational consequences of a major security failure.
Looking Ahead
Binance’s immediate priority will be to complete the recovery process, maintain withdrawal and deposit operations, and demonstrate that its security systems have been strengthened. Investors and customers will likely monitor net flows, trading liquidity and further updates from the company as the investigation progresses.
For the wider cryptocurrency industry, the attack could increase pressure on exchanges to improve wallet security, strengthen internal controls and provide clearer information about how customer assets are protected. Whether Binance can restore confidence will depend not only on replacing the stolen funds but also on demonstrating that similar vulnerabilities have been addressed.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
