Binance is working to restore services and protect customer trust after a major cyberattack affected digital assets worth about $6.3 billion. The cryptocurrency exchange reported billions of dollars in net withdrawals on November 1 as users reacted to the security breach.
The company suspended all transactions after the incident. It has since resumed some services and says it will cover the full financial impact of the stolen funds. Binance estimates that it has already covered about 95% of the assets affected by the attack. It warned that finding or replacing the remaining amount may take longer.
The US Federal Bureau of Investigation has accused North Korea of being behind the cyberattack. The incident is considered one of the largest cryptocurrency thefts ever reported.
Binance said it processed $4.649 billion in withdrawals between 06:00 and 15:30 GMT on November 1. During the same period, users deposited about $1.01 billion. This left the exchange with a net outflow of around $3.64 billion.
The company said withdrawals rose sharply at first but later slowed. It added that the flow of funds was stabilising as expected.
Despite the large amount withdrawn, Binance said the net outflow represented just over 2% of the $171 billion in assets under its management. The exchange also said it had set aside more than $6.34 billion to manage the effects of the incident.
Binance has repeatedly promised to cover all losses linked to the attack. It said customer assets had been replaced through several sources, including its corporate treasury, futures insurance and emergency reserve funds.
The exchange has also begun restoring withdrawals for more than two dozen major cryptocurrencies. These include Bitcoin and Ethereum. Binance said other services would return in stages after the company completes its security checks.
Investigators have linked the attack to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. The group has been accused of carrying out other major cryptocurrency thefts.
In 2025, the group was linked to the theft of about $1.5 billion from crypto exchange Bybit. That attack was described at the time as a record-breaking theft in the digital asset industry.
On Saturday, the FBI released a list of cryptocurrency wallet addresses connected to the group. It urged companies across the industry to help block transactions involving those addresses.
Binance also called on cryptocurrency issuers to freeze assets believed to be linked to the attack. Such steps can make it harder for criminals to move stolen funds through exchanges or other services.
The company said its early checks pointed to a possible security breach involving an engineer’s laptop. According to Binance, hackers may have gained access through the compromised device and found a way to make unauthorised transactions.
The investigation is still ongoing, and the company has not provided a full public account of how the attack happened.
The breach affected Binance.com, its global centralised exchange. The company’s US-facing platform said it was not affected by the incident.
The attack has raised fresh concerns about the safety of digital assets and the security systems used by major cryptocurrency exchanges. These platforms handle large sums of money and are attractive targets for organised cybercrime groups.
Cryptocurrencies are digital assets that people buy, sell and transfer through online platforms. They do not exist as physical cash and rely on computer systems, digital wallets and other technology to manage ownership and transactions.
A major breach can cause direct financial losses and weaken confidence in the wider market. It can also lead to tighter security checks and temporary limits on trading or withdrawals while companies investigate what happened.
Binance was founded in China and has grown into one of the world’s largest cryptocurrency exchanges, with hundreds of millions of registered users globally. Its response to the incident could influence how customers view the company’s ability to protect their funds.
For now, Binance says it remains committed to covering the losses and restoring normal services. The company has resumed some withdrawals, but the recovery process is continuing.
The FBI’s warning also highlights the need for cooperation between exchanges, cryptocurrency issuers and law enforcement agencies. As investigators trace the stolen assets, the industry faces growing pressure to improve security and stop criminals from moving funds after major attacks.
