Binance customers pulled billions of dollars off the platform on Sunday as the world’s largest cryptocurrency exchange began restoring services following a record $6.3 billion cyber heist, the company announced.
Between 6 a.m. and 3:30 p.m. UTC on Sunday, Binance processed approximately $4.65 billion in withdrawals alongside $1.01 billion in deposits, producing a net outflow of roughly $3.64 billion. The exchange said the departing capital represented 2.1 percent of the $171 billion in total assets under its management, based on company reserve disclosures from late October.
The exchange had previously suspended all activity after attackers compromised the platform late last week. Withdrawal activity peaked early Sunday before slowing down, according to Binance executives, who said operations were stabilizing.
Reimbursements and asset recovery
Binance leadership maintained that user balances would be fully protected. The platform disclosed that it had already covered roughly 95 percent of the missing funds by buying replacement digital assets with company reserves, up from an initial replacement figure of 90 percent. Binance said the final 5 percent consists of less liquid tokens that require additional time to purchase in necessary quantities.
Company officials stated that the replacement assets were financed through the exchange’s corporate treasury, its Futures Insurance Fund, and its $1 billion emergency reserve known as the Secure Asset Fund for Users. Co-Chief Executive Yi He indicated the exchange would deploy half of the emergency fund while pledging to replenish the reserve back to its $1 billion threshold.
Blockchain tracking firms and financial partners have also assisted in restricting the movement of stolen funds. Stablecoin operator Circle confirmed that it worked alongside law enforcement to freeze more than $1.1 billion in USD Coin linked to the incident. Binance previously noted that around $3 billion of the affected assets had been located.
Investigators target North Korean group
U.S. authorities quickly linked the breach to state-sponsored actors. The Federal Bureau of Investigation said Saturday that the North Korean cyber unit known as TraderTraitor executed the theft. Federal investigators reported tracking the illicit actors as they moved stolen assets into ether before attempting to funnel them through decentralized finance protocols and instant swap services to obscure ownership.
Chainalysis senior manager Alec Zebrick told the BBC that illicit funds were being actively layered through thousands of individual addresses and deposit transactions. Binance Co-Chief Executive Richard Teng described the breach as a sophisticated attack that used malware designed to erase its tracks after infiltrating a compromised laptop.
President Donald Trump, however, struck a more cautious note regarding responsibility on Saturday, telling reporters that it remained uncertain whether Pyongyang orchestrated the attack and adding that the administration would address the matter with North Korea if that proved to be the case. North Korea has long denied running state-backed cyber operations for financial gain, and its diplomatic missions did not comment.
Analytics dashboard DefiLlama calculated higher Sunday outflows of $4.36 billion, though Binance disputed the metric, stating that external figures failed to account for deposits made into the company’s newly created hot wallet.
Binance founder Changpeng Zhao, who stepped down as chief executive after a federal conviction and was pardoned by Trump last year, thanked U.S. law enforcement agencies on social media for helping freeze assets. Zhao asserted that the vast majority of platform users decided against pulling their money.
Full trading and transfer operations remain partially restricted. Binance said Sunday that withdrawals had returned across 15 initial token networks, including bitcoin and ethereum, while engineers continue security evaluations before enabling remaining assets in coming days.
