Binance customers withdrew approximately $3.64 billion in net assets after the cryptocurrency exchange began restoring withdrawal services on November 1, following a security breach involving an estimated $6.3 billion in digital assets. The withdrawals came after Binance suspended transactions in response to the incident, which has been described as one of the largest cryptocurrency thefts on record. According to figures shared by the exchange, it processed approximately $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 GMT on November 1, resulting in net outflows of around $3.64 billion. The movement reflected customer activity during the initial reopening period, as users regained access to their funds after the temporary suspension. Binance said withdrawal demand initially increased sharply but subsequently declined, with outflows beginning to stabilise. The exchange also reported that deposits remained substantial during the period, indicating that customers continued to transfer funds onto the platform despite the security incident.
The withdrawal suspension followed an attack on Binance that affected approximately $6.3 billion worth of digital assets. The exchange temporarily restricted transactions while its teams investigated the breach, assessed its impact and carried out security checks. Binance subsequently began restoring withdrawals in phases, with access initially reopened for selected cryptocurrencies and networks. Bitcoin, Ethereum, XRP and other major digital assets were among those included in the initial restoration process, while additional services were expected to resume after further checks. The phased approach was intended to allow the exchange to verify the affected networks and assets before restoring normal operations across its platform. Binance has acknowledged the importance of reliable access to customer funds but said the suspension was a precaution while it worked to contain the incident and restore affected services. The exchange also warned users that transaction processing could take longer than usual because of increased activity following the reopening.
Binance has said it has covered approximately 95% of the stolen assets and intends to bear the financial impact of the breach rather than pass the losses on to customers. The company has reserved more than $6.34 billion to address the incident, using resources that include its corporate treasury and insurance and user-protection funds to acquire replacement tokens. The remaining assets are reportedly less liquid and may take additional time to source in the quantities required. Replenishing customer assets does not necessarily mean that the cryptocurrency stolen by the attackers has been recovered; it means the exchange is replacing the affected holdings through its own financial resources. The Federal Bureau of Investigation has attributed the attack to TraderTraitor, a North Korean-linked hacking group, and said the stolen assets were being converted into Ethereum. The FBI has urged cryptocurrency businesses and other industry participants to block transactions connected to wallet addresses associated with the group.
The outflows have drawn attention to customer confidence and the operational resilience of major cryptocurrency exchanges following large-scale cyber incidents. Although the $3.64 billion net withdrawal figure represents a substantial amount, it accounted for approximately 2.1% of Binance’s reported assets under management, according to the company’s figures. The exchange has said that withdrawal volumes declined after the initial surge and were stabilising, while deposits continued to come in. The incident nevertheless raises questions about digital asset custody, cybersecurity controls and the ability of trading platforms to maintain access to customer funds during emergency situations. Binance has said it will continue restoring affected services, completing security checks and working with law enforcement and industry partners. The company is also expected to provide a more detailed account of the incident once its investigation is complete. The pace of further withdrawals, recovery of stolen assets and publication of the technical findings will remain important indicators of the exchange’s recovery.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
