SINGAPORE/PARIS/NEW YORK — Binance’s customers have withdrawn a net $4.72 billion from the world’s biggest cryptocurrency exchange since it reopened, after hackers stole around $6.3 billion of crypto from the platform in what could be the largest-ever financial heist.
The exchange froze withdrawals for more than two days after the hack, which the FBI said was carried out by North Korea, then started allowing customers to withdraw again on Sunday morning.
The theft has underlined the vulnerability of digital assets to attacks and raised questions about the impact of the hack on Binance, which has vowed to repay customers in full.
Binance said the net outflows amounted to around 3 per cent of the assets on its platform, a relatively modest figure that analysts said suggested customer confidence had largely held up. Most withdrawals from the platform were in the form of Tether’s USDT stablecoin, Binance added.
The outflow compares with about $7 billion withdrawn from Circle’s USDC stablecoin over a week after the collapse of Silicon Valley Bank in 2023. Binance itself processed net outflows of about $6 billion over 72 hours in 2022 after the collapse of FTX.
The attack marks a step-up in North Korea’s crypto thefts. Blockchain analytics firm TRM Labs said North Korea-linked hackers have stolen $7.4 billion so far in 2026.
Analysts and crypto experts said the fallout appeared limited so far, and there was little sign of an impact on broader financial markets despite deepening ties between crypto and mainstream finance in recent years.
“Binance will absorb the financial impact of the stolen funds, not our users,” the company said in a statement on X.
Binance said it was covering the losses with company funds and had already raised $6 billion from its corporate treasury, an insurance fund and reserves set aside for security breaches.
“It has not yet triggered widespread panic or a massive, concentrated withdrawal,” said Tim Sun, a senior researcher at HashKey Group 3887.HK, a digital asset financial service company in Hong Kong.
Binance, which says it has more than 335 million users worldwide and average daily trading volumes of $95 billion across digital assets and derivatives, said it had also seen $2.7 billion in customer inflows since Sunday and that withdrawal volumes were stabilizing after an “initial spike.”
Data from data analytics provider DeFiLlama showed several crypto exchanges received notable inflows to their platforms since Binance opened withdrawals, although it was unclear what share came from users moving funds off Binance.
OKX recorded $284.87 million in inflows in the last 24 hours, followed by Gate with $93.22 million in inflows and Bybit, which saw $29.25 million in inflows. Representatives for OKX, Gate and Bybit did not respond to requests for comment.
NO RUSH TO WITHDRAW
Some traders told Reuters they were keeping their accounts on Binance.
Ryan Tan, a Binance user, said he was in no hurry to withdraw his funds from the platform, as he had already kept his account fairly light since the collapse of FTX four years ago.
“After the FTX collapse, I decided to hold everything on my wallet instead of leaving them on exchanges,” said the 39-year-old.
After hitting a six-week low on Friday, bitcoin BTC= prices recovered through the weekend to trade above $77,000 on Monday, while ether ETH= also rebounded from a two-month low.
Stablecoin market capitalizations, often viewed as a gauge of money moving into and out of crypto markets, have fallen since Friday, suggesting some investors have shifted funds into cash or traditional assets. Binance started allowing US dollar cash withdrawals again on Monday.
“HIGHLY COMPLEX” MONEY LAUNDERING
The FBI said on Saturday that the North Korean state-sponsored group TraderTraitor was responsible for the attack. Researchers describe the group as highly sophisticated and say its activities help fund the country’s weapons programs.
Analysts said the attack’s scale could curb institutional appetite for cryptocurrencies. Spot bitcoin ETFs recorded outflows of $643 million on Friday, the largest daily withdrawal in October, while more than $1.3 billion in leveraged positions were liquidated, according to Ari Redbord, global head of policy at TRM Labs.
“A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people’s capital,” he said.
About half of the stolen funds were held in stablecoins and have been frozen by issuers including Circle, which said on Monday it had frozen more than $1.1 billion in USDC USDC=.
According to blockchain analytics firm Elliptic, the hackers still control around $3.28 billion, mostly in bitcoin and ether, and only a negligible amount has been cashed out of crypto and into fiat currency. Elliptic described the laundering process as “highly complex and clearly automated.”
Jonathan Benton, founder and chief executive at crypto asset recovery firm iSanctuary, said blockchain technology exists to trace stolen funds, but the challenge is turning that intelligence into rapid, coordinated action before those assets disappear.
“The future of crypto won’t be decided by how much money enters the market, but by how safe that money is once it’s there,” said Benton, former head of the international corruption unit of the UK’s National Crime Agency.
(Reporting by Rae Wee and Ankur Banerjee in Singapore, Elizabeth Howcroft in Paris and Hannah Lang in New York; Writing by Scott Murdoch and Tom Westbrook; Editing by Sonali Paul, Xevi Fontdegloria, Mark Potter, Rod Nickel)
