SINGAPORE/PARIS/NEW YORK – Binance’s customers have withdrawn a net US$4.72 billion (S$6 billion) from the world’s biggest cryptocurrency exchange since it reopened, after hackers stole around US$6.3 billion of crypto from the platform in what could be the largest-ever financial heist.
The exchange froze withdrawals for more than two days after the hack, which the FBI said was carried out by North Korea, then started allowing customers to withdraw again on the morning of Nov 1.
The theft has underlined the vulnerability of digital assets to attacks and raised questions about the impact of the hack on Binance, which has vowed to repay customers in full.
Binance said the net outflows amounted to around 3% of the assets on its platform, a relatively modest figure that analysts said suggested customer confidence had largely held up. Most withdrawals from the platform were in the form of Tether’s USDT stablecoin, Binance added.
The outflow compares with about US$7 billion withdrawn from Circle’s USDC stablecoin over a week after the collapse of Silicon Valley Bank in 2023. Binance itself processed net outflows of about US$6 billion over 72 hours in 2022 after the collapse of FTX.
The attack marks a step-up in North Korea’s crypto thefts. Blockchain analytics firm TRM Labs said North Korea-linked hackers have stolen US$7.4 billion so far in 2026.
Analysts and crypto experts said the fallout appeared limited so far, and there was little sign of an impact on broader financial markets despite deepening ties between crypto and mainstream finance in recent years.
“Binance will absorb the financial impact of the stolen funds, not our users,” the company said in a statement on X.
Binance said it was covering the losses with company funds and had already raised US$6 billion from its corporate treasury, an insurance fund and reserves set aside for security breaches.
“It has not yet triggered widespread panic or a massive, concentrated withdrawal,” said Tim Sun, a senior researcher at HashKey Group, a digital asset financial service company in Hong Kong.
Binance, which says it has more than 335 million users worldwide and average daily trading volumes of US$95 billion across digital assets and derivatives, said it had also seen US$2.7 billion in customer inflows since Nov 1 and that withdrawal volumes were stabilising after an “initial spike.”
Data from data analytics provider DeFiLlama showed several crypto exchanges received notable inflows to their platforms since Binance opened withdrawals, although it was unclear what share came from users moving funds off Binance.
OKX recorded US$284.87 million in inflows in the last 24 hours, followed by Gate with US$93.22 million in inflows and Bybit, which saw US$29.25 million in inflows. Representatives for OKX, Gate and Bybit did not respond to requests for comment.
No rush to withdraw
Some traders told Reuters they were keeping their accounts on Binance.
Ryan Tan, a Binance user, said he was in no hurry to withdraw his funds from the platform, as he had already kept his account fairly light since the collapse of FTX four years ago.
“After the FTX collapse, I decided to hold everything on my wallet instead of leaving them on exchanges,” said the 39-year-old.
After hitting a six-week low on Oct 30, bitcoin prices recovered through the weekend to trade above US$77,000 on Nov 2, while ether also rebounded from a two-month low.
Stablecoin market capitalisations, often viewed as a gauge of money moving into and out of crypto markets, have fallen since Oct 30, suggesting some investors have shifted funds into cash or traditional assets. Binance started allowing US dollar cash withdrawals again on Nov 2.
‘Highly complex’ money laundering
The FBI said on Oct 31 that the North Korean state-sponsored group TraderTraitor was responsible for the attack. Researchers describe the group as highly sophisticated and say its activities help fund the country’s weapons programmes.
Analysts said the attack’s scale could curb institutional appetite for cryptocurrencies. Spot bitcoin ETFs recorded outflows of US$643 million on Oct 30, the largest daily withdrawal in October, while more than US$1.3 billion in leveraged positions were liquidated, according to Ari Redbord, global head of policy at TRM Labs.
“A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people’s capital,” he said.
About half of the stolen funds were held in stablecoins and have been frozen by issuers including Circle, which said on Nov 2 it had frozen more than US$1.1 billion in USDC.
According to blockchain analytics firm Elliptic, the hackers still control around US$3.28 billion, mostly in bitcoin and ether, and only a negligible amount has been cashed out of crypto and into fiat currency. Elliptic described the laundering process as “highly complex and clearly automated.”
Jonathan Benton, founder and chief executive at crypto asset recovery firm iSanctuary, said blockchain technology exists to trace stolen funds, but the challenge is turning that intelligence into rapid, coordinated action before those assets disappear.
“The future of crypto won’t be decided by how much money enters the market, but by how safe that money is once it’s there,” said Benton, former head of the international corruption unit of the UK’s National Crime Agency. REUTERS