Binance Customers Withdraw $3.64 Billion as Trading Resumes

Binance customers withdrew $3.64 billion, equivalent to 2.1 percent of its assets, as the world’s largest cryptocurrency exchange resumed operations following a security breach linked to North Korea that led to the theft of $6.3 billion from the platform last week, Reuters reported.

Binance stated that withdrawal volumes began to stabilize after an initial surge, and deposit volumes remained “large” in the wake of what analysts believe may be the largest financial heist in history. After Bitcoin’s price hit a six-week low on Friday, it recovered slightly early in the week, surpassing $78,000 on Monday. Ethereum also fell to a two-month low on Friday before recovering modestly to $2,287.

Binance allows users to buy, sell, and trade digital assets and has 335 million registered users worldwide. On Sunday, the company said its total assets under management reached $171 billion as of October 28.

The Binance theft adds to a recent series of cryptocurrency asset thefts. According to researchers at TRM Labs, attackers stole $2.9 billion in cryptocurrencies last year through approximately 150 attacks.

The pace of withdrawals serves as an early test of customer confidence in the platform following the breach. The company said it had covered 95 percent of the stolen assets in the incident.

The market value of stablecoins typically declines when funds exit the cryptocurrency market, and it has fallen since Friday. CoinMarketCap reported that the combined market capitalization of the two largest stablecoins, USDT and USDC, dropped by approximately $1.2 billion since Friday.

Ari Redbord, Global Head of Policy at the US blockchain analytics firm TRM Labs, said that spot Bitcoin-linked exchange-traded funds recorded $643 million in outflows on Friday, marking the largest daily outflows in October, alongside the liquidation of positions worth over $1.3 billion.

He added, “A breach of a financial institution means the theft of usernames and passwords, whereas a breach of a cryptocurrency exchange is akin to a bank robbery at internet speed, creating an unstable risk pattern for anyone responsible for other people’s capital.”

Despite these measures, some users are exploring options to hedge against risks.

Jay Koh, Vice President of the Asia Web3 AI Association, said he had not withdrawn any of his holdings from Binance, as most of his funds were held in a wallet unaffected by the breach.

He stated, “I won’t necessarily withdraw everything from Binance... but I believe it is prudent to review exposure levels, diversify custody arrangements, and avoid holding more assets on any single platform than necessary.”

Binance, which was founded in China, said that withdrawal operations would be rolled out in phases, prioritizing user demand. The first phase included 15 digital assets, such as Bitcoin, Ethereum, and some stablecoins like USDC, USDT, and Dogecoin.

In a previous post on the X platform, the exchange stated, “We are following a phased approach by prioritizing tokens based on user demand data from last week.” It added, “Rest assured, market conditions are stable.”

Binance said that the net outflows reflect what customers withdrew and deposited following the incident. Crypto analytics platform DeFi Llama, in its dashboard, reported that outflows were higher, reaching $5.81 billion, up from $4.36 billion shown earlier. Binance had not yet responded to a request for comment on the updated figures.

A Binance spokesperson, commenting on DeFi Llama’s initial data, said, “This figure does not include the flows we deposited into our new hot wallet, and is therefore inaccurate. Our latest update on X is closer to accuracy, taking into account deposit and withdrawal movements that have occurred since it was published.”

The U.S. Federal Bureau of Investigation said on Saturday that a North Korean state-sponsored unit known as Trader Trezor was responsible for the attack.

Pyongyang has long denied using state-linked cyber units for espionage, financial theft, and revenue generation. Its mission in Geneva and its embassy in China did not respond to requests for comment.

The FBI added in a statement that law enforcement had observed members of the unit converting stolen assets into Ether cryptocurrency, anticipating “further asset laundering” using related technology.

Analysts attributed the Binance theft to North Korea. Most of the thefts occurred over approximately 20 minutes, starting late Thursday, and bore similarities to major previous attacks for which North Korea was blamed, according to U.S. blockchain analytics firms TRM Labs and Chainalysis.

However, U.S. President Donald Trump said on Saturday that the United States remained unsure of North Korea’s involvement.

Trump told reporters, in comments posted via a White House account on X: “We don’t know if North Korea was behind it, but if it was, we will talk to North Korea about it.”