Binance has reported billions of dollars in withdrawals after a major cyberattack affected digital assets worth about $6.3 billion. The cryptocurrency exchange said it had processed large amounts of money leaving its platform, but that withdrawals were now starting to settle.
The company stopped all transactions after the incident. It has since worked to restore services and protect customer funds. Binance said it had covered about 95% of the stolen assets, while the rest could take more time to recover or replace.
The US Federal Bureau of Investigation has accused North Korea of carrying out the attack. The incident has been described as one of the largest cryptocurrency hacks ever reported.
Binance said it processed $4.649 billion in withdrawals between 06:00 and 15:30 GMT on November 1. During the same period, customers deposited about $1.01 billion. This left a net outflow of roughly $3.64 billion.
The exchange said withdrawals rose sharply at first. However, the pace later slowed and began to stabilise. Binance said the net outflow represented just over 2% of the $171 billion in assets it manages.
The company had already said it held more than $6.34 billion in funds to deal with the impact of the attack. It has also promised to cover all financial losses linked to the incident.
In a statement, Binance said its commitment to customers had not changed. The company said it would fully cover the financial impact of the stolen funds.
The exchange has started restoring withdrawals for more than two dozen major cryptocurrencies, including Bitcoin and Ethereum. Other services are expected to return in stages after security checks are complete.
The attack has been linked to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. The group has been linked to other major thefts involving digital assets.
In 2025, the group was blamed for stealing about $1.5 billion from cryptocurrency exchange Bybit. That incident was then described as a record-breaking crypto theft.
On Saturday, the FBI published a list of cryptocurrency wallet addresses linked to the group. It also urged companies across the industry to help block transactions involving those addresses.
The move was part of efforts to stop the stolen funds from being moved or exchanged. Binance also urged cryptocurrency issuers to freeze assets that may have been affected by the attack.
The exchange said early checks suggest the incident may have started with a compromised laptop belonging to an engineer. Investigators believe the device may have helped hackers find a way to carry out unauthorised transactions.
The breach affected Binance.com, the company’s global centralised exchange. Binance’s US-facing platform said it was not affected.
Binance said it had replaced customer assets using several sources. These included company funds, insurance for futures trading and emergency reserve funds. The company has not changed its promise to make customers whole.
The incident has renewed concerns about security in the cryptocurrency market. Digital assets are traded and stored through online platforms, wallets and computer systems. Unlike cash, they do not exist in physical form, so users depend on digital tools to manage them.
Large exchanges often hold billions of dollars in customer assets. This makes them major targets for cybercriminals. A successful attack can cause large losses and shake trust in the wider market.
Binance was founded in China and now serves hundreds of millions of registered users around the world. The company is among the largest players in the cryptocurrency industry.
For now, Binance faces two key tasks: restoring normal services and maintaining trust among its customers. The company says it will cover the stolen funds, but the full recovery process may take time.
The FBI’s warning also highlights the need for exchanges and other crypto firms to share information and block suspicious transfers. As the investigation continues, the industry will be watching to see how much of the stolen money can be traced and whether further security measures can prevent similar attacks.
