Binance customers withdrew $3.64 billion, representing 2.1% of its assets, as the cryptocurrency exchange reactivated its services on Sunday. This follows a security breach last week, which the FBI has linked to hackers associated with North Korea and resulted in the theft of $6.3 billion.
A Binance spokesperson stated that withdrawal activity had begun to stabilize, with deposit volumes remaining substantial. The exchange also announced it had recovered 95% of the stolen assets. The total net outflows reported by Binance reflect customer deposits and withdrawals as of 1530 GMT.
Analysts have noted this incident as potentially the largest financial robbery on record, adding to a series of recent cryptocurrency thefts. According to TRM Labs, approximately $2.9 billion in cryptocurrency was stolen across nearly 150 incidents in the previous year.
Binance, founded in China, is implementing a phased rollout for withdrawals, prioritizing tokens based on user demand observed over the past week. Initial phases include popular cryptocurrencies such as bitcoin, ether, and certain stablecoins like USDC and USDT, along with dogecoin.
The exchange had previously stated it would cover the financial impact of the hack using company funds. Approximately $6 billion of the stolen cryptocurrency has been replaced with company money, while the remaining 5% of less liquid assets may take longer to source.
The FBI identified the North Korean state-sponsored hacking group, known as Lazarus or TraderTraitor, as responsible for the attack. Pyongyang has consistently denied using state-linked cyber units for illicit activities. Law enforcement observed the group converting stolen assets into ether and anticipates further laundering through related technologies.
Blockchain analysis firms TRM Labs and Chainalysis had previously pointed to North Korea's potential involvement, noting similarities to prior attacks attributed to the nation. However, President Trump stated that the extent of North Korea's involvement remained unclear.
Binance has been collaborating with other crypto firms to freeze some of the affected assets, with about $3 billion reportedly located as of Friday. The exchange has committed company funds, including from its Secure Asset Fund for Users (SAFU), its Futures Insurance Fund, and its corporate treasury, to cover the losses. Co-CEO Yi He indicated that 50% of SAFU funds would be utilized, with a commitment to replenish the fund to approximately $1 billion. Co-CEO Richard Teng described the breach as a "complex attack" involving a compromised laptop and malicious software designed to obscure evidence.
Binance, which serves 335 million registered users globally, reported $171 billion in total assets under management as of October 28. Following the breach, cryptocurrency prices experienced a decline, while Binance worked to assure customers of their fund security.