Binance customers withdrew $3.64 billion — 2.1% of the exchange’s assets — within hours of the platform coming back online Sunday, days after hackers the FBI has tied to North Korea stole $6.3 billion in what analysts believe may be the largest financial theft in history.
Binance says the rush of withdrawals has since stabilized and deposit volumes have stayed “substantial.” The exchange says it has now covered 95% of the stolen funds.
Crypto analytics platform DefiLlama put total outflows higher, at $4.36 billion. A Binance spokesperson disputed that figure: “This figure does not contain the flows we have deposited to our own new hot wallet, so they are not accurate. Our last update on X is closest to accurate (outstanding the moves in both deposits and withdrawals since it was posted).”
Binance, founded in China and now serving 335 million registered users worldwide with $171 billion in assets under management as of October 28, is rolling out withdrawals in phases based on user demand. The first phase covered 15 tokens, including bitcoin, ether, dogecoin, and some USDC and USDT stablecoins.
How the money is being replaced
Binance said it covered $6 billion of the stolen crypto by buying replacement tokens with company funds. The remaining 5% consists of less liquid assets that may take longer to source. The exchange has set aside roughly $6.34 billion of its own money to make customers whole and insists it will absorb the full financial hit itself.
The replacement funds came from Binance’s $1 billion Secure Asset Fund for Users (SAFU), part of its Futures Insurance Fund, and its corporate treasury. Co-CEO Yi He said Saturday that Binance would spend 50% of its SAFU reserves and has committed to rebuilding the fund back to roughly $1 billion.
North Korea blamed — but not by everyone
The FBI said Saturday that the North Korean state-sponsored hacking unit known as TraderTraitor carried out the attack. Investigators observed the group converting stolen assets into ether and expect “further laundering” through related technology, according to the bureau’s statement. Pyongyang has long denied running state cyber units for espionage and theft, and its mission in Geneva and embassy in China did not respond to requests for comment.
Blockchain analysis firms TRM Labs and Chainalysis both pointed to North Korean involvement, noting the bulk of the theft happened in roughly 20 minutes late Thursday in a pattern consistent with previous North Korea-linked attacks.
President Trump struck a more cautious tone Saturday. “We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it,” he told reporters, according to comments posted by a White House account on X.
Recovery effort and the bigger picture
Binance says it has been working with other crypto firms to freeze stolen assets, locating about $3 billion of them as of Friday. Co-CEO Richard Teng has described the breach as a “complex attack” involving a compromised laptop and malicious software built to erase traces of the intrusion, making it harder to trace.
Crypto prices dropped Friday as news of the hack spread. The theft adds to a wave of crypto crime; researchers at TRM Labs say attackers stole $2.9 billion in cryptocurrency across nearly 150 separate incidents last year alone.
Binance founder Changpeng Zhao, who was convicted in the US of failing to maintain an anti-money laundering program before being pardoned by Trump last year, publicly thanked the FBI for its role in tracking and freezing stolen assets.
“A tweet can’t fully express our gratitude. Many crypto bros may not realize, a lot of the ‘why bitcoin didn’t drop more?’ credit goes to them,” Zhao wrote.
Binance did not respond to a request for comment on North Korea’s alleged involvement.
