Binance
CEO of cryptocurrency company Binance, Richard Teng poses during a photo session as part of an interview with AFP at his office in Paris, on April 9, 2024. Unsplash/Kanchanara

Customers have withdrawn a net $4.7 billion from Binance following last week's record cryptocurrency hack as the world's largest crypto exchange works to restore services and reassure users that their funds remain protected.

The withdrawals followed the reopening of customer accounts after a roughly 45-hour suspension triggered by an estimated $6.3 billion cyberattack on Thursday.

Despite the substantial withdrawals, the money leaving Binance represented a relatively small proportion of its overall holdings. The exchange said activity had begun stabilizing after an initial surge, with customers continuing to deposit funds even as others moved their cryptocurrency elsewhere.

Binance's official transaction figures provide a closer look at the first hours after withdrawals resumed Sunday. Between 6 a.m. and 3:30 p.m. UTC, customers withdrew approximately $4.65 billion and deposited $1.01 billion, resulting in net outflows of $3.64 billion. The exchange said that represented 2.1% of its $171 billion in assets, based on its Oct. 28 proof-of-reserves figures.

The larger $4.7 billion total reflects withdrawals recorded over a longer period. Both figures represent money customers moved out of Binance after the attack, rather than additional funds stolen by hackers.

Read more

The company began restoring withdrawals in stages Sunday morning, initially allowing transactions involving major cryptocurrencies such as Bitcoin, Ether, BNB, Solana and XRP.

All 15 networks and assets included in the first reopening phase were available by 12:36 p.m. UTC, although other cryptocurrencies remained subject to additional security checks.

Binance said the gradual reopening was necessary to verify that affected systems were operating safely before allowing customers to move their remaining assets.

The company has also been using its own money to replace cryptocurrency lost in the attack. In its recovery update, Binance said it had replenished approximately 95% of the affected assets, up from 90% in its previous update.

The remaining 5% consisted mainly of less liquid cryptocurrencies that were taking longer to purchase in sufficient quantities. Binance said balances involving major assets, including Bitcoin, Ether, BNB, Solana, XRP and leading stablecoins, were fully backed.

The exchange has promised to absorb the losses rather than pass them on to customers, using its corporate resources and emergency protection funds.

The attack on Binance was one of the largest cryptocurrency thefts ever recorded, exceeding the $1.5 billion stolen from rival exchange Bybit in February 2025. U.S. authorities have since identified the group believed to be responsible.

In a statement, the Federal Bureau of Investigation attributed the theft to North Korea's TraderTraitor hacking operation, which has previously targeted cryptocurrency businesses.

The FBI said the attackers were converting stolen assets primarily into Ether and could use decentralized financial platforms and cryptocurrency exchange services to move the funds through additional transactions.

Working with the U.S. Secret Service and IRS Criminal Investigation, the bureau urged cryptocurrency businesses and blockchain service providers to block transactions connected to identified wallets holding stolen assets.

Binance has said approximately $3 billion in affected cryptocurrency was frozen with assistance from industry partners. Those restrictions prevent the assets from being transferred but do not necessarily mean the funds have been recovered.

The investigation into how the attackers gained access to Binance's systems remains ongoing. The exchange initially identified a compromised employee laptop as one possible entry point, although subsequent investigations uncovered additional areas of concern. Binance said it had found no evidence that wallet private keys, which are used to authorize cryptocurrency transactions, were leaked.

The company has promised to publish a detailed technical report once the investigation is complete. Meanwhile, blockchain data providers have been monitoring cryptocurrency movements across major trading platforms.