Binance users withdraw billions in crypto following record North Korean hack

Investors have fled with billions from cryptocurrency exchange Binance after an unprecedented cyber-heist saw hackers steal nearly $9 billion from the platform, according to initial reports, with absolute figures later centered around a staggering $6.3 billion theft. On Thursday evening, hackers siphoned billions of dollars in cryptocurrency from the exchange's internet-connected hot wallets over a span of roughly 20 minutes. The cyberattack — which US authorities have since pinned on state-sponsored hackers from North Korea — has been described as the largest cryptocurrency heist on history.

Following the breach, Binance initially froze customer withdrawals for more than two days to conduct urgent investigations and contain the loss. The platform started to restore access to funds at approximately 5 pm Sunday, Nov. 1, 2026, as detailed by ACS Australia. Over the subsequent nine and a half hours, the company processed a wave of multi-billion-dollar withdrawals alongside significant deposits. Outflows and inflows varied across analytical tracking methods and timeframes reported by different financial platforms.

Media additions

Binance users withdraw billions after cryptocurrency hack

Metric Reported	Binance Official Figures	Alternative / External Tracking
Total Stolen Funds	$6.3 billion	$6.3 billion to $6.4 billion (CBS News, New York Post)
Customer Withdrawals Processed	$4.6 billion to $4.65 billion	$4.7 billion to $4.72 billion (New York Post, The Globe and Mail)
Customer Deposits Received	$1 billion to $1.01 billion	$2.7 billion across wider inflow windows (The Globe and Mail)
Net Outflows	$3.6 billion to $3.64 billion (2.1% of assets)	$5.8 billion over 24 hours via DeFiLlama data (Around Prague)
Total Assets Under Management	$171 billion (as of Oct. 28, 2026)	$157 billion remaining post-heist (New York Post)

The cyberattack impacted between 30 and 40 separate cryptocurrency tokens across 10 blockchains, including heavy-hitters such as Bitcoin, Ether, and US dollar-backed stablecoins USDT and USDC. Binance was quick to declare that the company, not its users, would absorb the financial impact of the stolen funds. Co-chief executive Richard Teng stressed that Binance was built to weather a theft of this scale.

"Bottom line – your money is safe, and we're covering every loss"

Richard Teng, Co-CEO, via ACS Australia

Binance stated it had already set aside company funds and covered roughly 95 percent of the hacked losses by Saturday, Oct. 31, 2026, though the remaining five percent consisted of less liquid tokens that would take longer to source. The platform utilized part of its $1 billion Secure Asset Fund for Users (SAFU), its futures insurance fund, and its corporate treasury.

The company also worked with industry partners and stablecoin issuers like Circle to freeze approximately $3 billion to $4.26 billion of affected assets. According to blockchain analytics firm Elliptic, approximately $3.24 billion to $3.28 billion remained in addresses linked to the theft, with hackers converting holdings primarily into Ethereum. Additional details on internal security failures emerged as investigations progressed. Richard Teng noted that the breach was a complex attack involving a compromised employee laptop belonging to a DevOps engineer, which allowed attackers to submit unauthorized withdrawal transactions before deploying a self-destruct mechanism to delete tooling and tracers.

Raghu Nandakumara, vice president of industry strategy at cybersecurity platform Illumio, observed that the laptop was already authenticated and privileged, providing a direct route into production environments. While Binance confirmed no customer wallet private keys were leaked, the incident has reverberated across international markets and political channels. On Saturday, Nov. 1, 2026, the Federal Bureau of Investigation (FBI) officially accused the Democratic People's Republic of Korea of responsibility, specifically naming the state-sponsored threat actor 'TraderTraitor'. The FBI noted that TraderTraitor was also behind a previous $1.5 billion hack at cryptocurrency exchange Bybit in February 2025.

Despite the historic scale of the breach, market reactions remained relatively contained compared to past collapses like FTX. Bitcoin prices recovered through the weekend of Nov. 1-2, 2026, trading above $77,000 to $78,000 on Monday, Nov. 2, 2026, while Ether and other major assets stabilized after initial dips. Industry analysts offered varied assessments on institutional sentiment. Tim Sun, a senior researcher at HashKey Group, noted that the incident had not triggered widespread panic, though security concerns could affect institutional asset allocations. Conversely, Ari Redbord, global head of policy at TRM Labs, warned that a hack of this magnitude creates an unstable risk profile for anyone managing institutional capital, pointing to $643 million in spot bitcoin ETF outflows on Friday, Oct. 30, 2026.

Meanwhile, experts like Jonathan Benton, founder of iSanctuary and former head of the international corruption unit of the UK's National Crime Agency, emphasized that the future of cryptocurrency relies entirely on transactional safety once capital enters digital vaults.

Users and market observers continue to monitor developments across the business sector as Binance completes its phased network restorations. Binance has not yet provided a definitive calendar for the complete reopening of all remaining minor asset pairs. The exchange stated it will publish a comprehensive, detailed post-mortem report once its internal investigations and security verifications are fully finalized.