Binance users withdrew $3.6bn (£2.7bn) from the world’s largest cryptocurrency exchange on Sunday, shortly after the platform reopened following what is believed to be the biggest cyber‑attack in history. The breach impacted $6.3bn of digital assets, prompting the US Federal Bureau of Investigation (FBI) to accuse a North Korean cyber‑crime group of the assault. Binance has said it has covered roughly 95 % of the stolen value and remains committed to reimbursing all affected customers, though the remaining funds may take longer to recover. The incident also triggered a sharp spike in withdrawals, which later stabilised as the exchange resumed limited services.
The scale of the breach and immediate market reaction
The hack struck Binance’s global centralised platform, Binance.com, while its US‑focused service remained untouched. Early forensic work suggests the attackers gained initial access through a compromised laptop belonging to an engineer, allowing them to orchestrate unauthorised transactions across the network. The breach affected $6.3bn of assets under management, representing just over 2 % of the exchange’s $171bn total. Between 06:00 and 15:30 GMT on 1 November, the firm processed $4.649bn in withdrawals and $1.01bn in deposits, resulting in a net outflow of approximately $3.64bn. This rapid capital movement highlighted the fragility of confidence in a platform that handles a fifth of the world’s crypto volume.
Binance’s response and compensation plan
Binance moved swiftly to protect its users, suspending all trading activity during the investigation and later reopening with phased service restoration. The exchange announced that it had reserved more than $6.3bn in internal funds, drawing from its corporate treasury, futures insurance pool and emergency reserve to replace customer assets. In a statement posted on X, Binance confirmed the withdrawal figures and noted that the “initial spike” in customer outflows had “stabilised as expected”. The firm reiterated its pledge to “fully cover the financial impact of the funds stolen in this incident”, emphasising that its commitment remained unchanged despite the ongoing recovery efforts.
Attribution to North Korea’s Lazarus Group and industry fallout
The FBI publicly linked the attack to TraderTraitor, the cyber‑crime unit also known as the Lazarus Group, which has a history of high‑profile heists. Most notably, the same group stole a record $1.5bn from Bybit in 2025. On Saturday, the bureau released a list of cryptocurrency wallet addresses tied to the operation and urged exchanges and service providers to block any transactions involving those accounts. Binance, in turn, called on token issuers to freeze affected assets, while collaborating with Chainalysis and various governmental agencies to trace and recover the stolen funds. The coordinated industry response underscores the growing recognition that state‑backed actors are increasingly targeting digital‑asset platforms.
Ongoing laundering concerns and future security measures
According to Alec Zebrick, senior manager in global services at Chainalysis, the stolen money continues to be actively laundered. “We continue to see funds being laundered quite actively,” he told the BBC’s Today Programme, noting that the attackers are “layering these funds across many thousands of addresses, across thousands of deposits”. This sophisticated layering technique makes recovery particularly challenging, as the funds are dispersed through a vast network of micro‑transactions. Binance has indicated that additional security checks will be completed before full service resumption, and that withdrawals of major cryptocurrencies such as Bitcoin and Ethereum will be progressively reinstated. The exchange also signalled a review of its internal controls, focusing on endpoint security and engineer access protocols to prevent similar compromises.
Why it Matters
The Binance incident marks a pivotal moment for the cryptocurrency sector, exposing how a single breach can trigger a $3.6bn capital flight and erode trust across the entire market. The alleged involvement of a state‑backed group underscores the escalating geopolitical dimensions of cyber‑crime, prompting regulators and industry players to accelerate cooperation on threat intelligence sharing and asset freezing. Moreover, the scale of the hack—impacting $6.3bn of assets—highlights the urgent need for robust insurance mechanisms and contingency reserves within exchanges. As the industry grapples with the aftermath, the event serves as a stark reminder that the security of digital finance is now a cornerstone of global financial stability, influencing investor confidence far beyond the crypto community.
