Binance Users Pull $3.6 Billion After Record $6.3 Billion Hack: What Happens Next

Binance, the world's largest cryptocurrency exchange, reported a net outflow of about $3.6 billion in cryptoassets after it restored customer withdrawals on Sunday, in the aftermath of a cyber theft of roughly $6.3 billion that the US Federal Bureau of Investigation and blockchain-analytics firms have attributed to North Korean hackers.

The exchange had halted withdrawals immediately after Thursday's attack while it investigated and worked to stabilise its systems. It has said it will reimburse affected customers in full. In updates posted on X, the company said the volume of withdrawals eased after an initial spike.

Binance said it has so far replaced about 95 per cent of the stolen cryptocurrency using its corporate treasury along with emergency and insurance funds. The tokens taken were a mix of major cryptocurrencies held across 10 blockchains, including Bitcoin and Ether.

"Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds," the company said. "These losses will not be passed on to users."

Withdrawals were restored in stages. The first phase covered 15 tokens, including Ether and the two largest stablecoins, Tether's USDT and Circle Internet Group's USDC. That was followed by withdrawals on 15 blockchain networks, including Ethereum, BNB Smart Chain, XRP and Base. Co-Chief Executive Officer Yi He said on X that not all of the outflows came from customers, as some transfers were between Binance wallets.

Why the size matters

The theft is the largest cyber heist on record in the crypto sector. The next-biggest attack, on the exchange Bybit in 2025, was a fraction of the latest one. Binance reported $171 billion in assets under management as of October 28 in its Sunday post. The next-largest exchange, OKX, holds about $29 billion, according to the same comparison.

That scale is central to how the episode unfolds. Trading in crypto is heavily concentrated on a handful of venues, and Binance's deep liquidity makes it difficult for professional traders to avoid entirely.

"We won't pull money off," said Vincent Liu, chief investment officer at Kronos Research. "Binance is the platform with most liquidity. If you want to trade or hedge in crypto, you will have to be on Binance. I do expect withdrawals but I also see many will come back as liquidity recovers."

Security questions

The reported cause of the breach — an employee's compromised laptop — has prompted scrutiny of Binance's cybersecurity protocols and renewed debate across the sector about how well customer funds are protected. The FBI and the US Secret Service are investigating the attack.

Several industry figures credited the exchange with reacting quickly, communicating frequently with customers and using company profits rather than user balances to cover the loss.

"On some level, this shows how much the industry has matured," said Haseeb Qureshi, managing partner at the venture fund Dragonfly. "We saw extraordinarily quick responses."

Markets so far

The market fallout appears contained. The value of most major cryptocurrencies moved by less than 1 per cent on Sunday. Bitcoin, which accounts for about 60 per cent of the sector's market value, was trading around $78,000 — roughly 5 per cent below its level before the theft.

The episode has also sharpened concern about the role of artificial intelligence in cyberattacks. A series of breaches at crypto firms and financial institutions this year has led some security experts to conclude that hackers — including North Korean groups — are using AI tools, particularly for reconnaissance and social engineering.

What to watch

Three things will shape what happens next: the pace at which customer deposits return once withdrawal limits are fully lifted; the findings of the US investigation and any regulatory response in the jurisdictions where Binance operates; and whether the industry adopts stricter custody and security standards. For ordinary users, the practical question remains unchanged — how much of their money is protected, and by whom, if an exchange is breached.