Binance Hack Fallout: $3.6 Billion Pulled Within Hours Of Withdrawal Resumption

Binance Cyberattack Triggers $3.6 Billion Withdrawals: Despite the firm assuring customers that their deposits were secure, customers withdrew $3.6 billion (£2.7 billion) worth of assets from the world's biggest cryptocurrency exchange within hours of the phased restoration of withdrawal services on Saturday, November 1. The massive outflow followed a cyberattack that the Federal Bureau of Investigation (FBI) attributed to North Korea, raising concerns among Binance's 335 million registered users worldwide. The firm informed customers that it had processed withdrawals worth nearly $3.64 billion.

"Between 06:00 and 15:30 UTC on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion. This represents 2.1% of our $171 billion in total assets under management (AUM), based on the latest available Proof of Reserves (PoR) data as of October 28, 2026.

"A new PoR snapshot was taken at 00:00 UTC on October 31, and zero-knowledge proof (ZKP) computation began. The updated report is expected to be available on our PoR website tomorrow," the firm said in a public statement on X, formerly Twitter.

Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026. By 12:36 UTC, withdrawals had resumed for all 15 networks and assets in the initial phase. After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial. Between 06:00 and 15:30 UTC on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion. This represents 2.1% of our $171 billion in total assets under management (AUM), based on the latest available Proof of Reserves (PoR) data as of October 28, 2026. A new PoR snapshot was taken at 00:00 UTC on October 31, and zero-knowledge proof (ZKP) computation began. The updated report is expected to be available on our PoR website tomorrow. Our team continues testing rigorously the remaining networks and assets. We know how important safe and reliable access to your funds is and will share details of the next phase as soon as we can. Rest assured that market conditions are stable. Thank you for your patience and continued support.

— Binance (@binance) November 1, 2026

It further assured customers that market conditions were stable and that it would announce details of the next phase of transaction services soon. Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026. By 12:36 UTC, withdrawals had resumed across all 15 networks and assets included in the initial phase. After an initial spike, withdrawal volumes declined and began stabilising, while deposit volumes remained substantial.

Between 06:00 and 15:30 UTC on November 1, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion. This represented 2.1% of its $171 billion in total assets under management (AUM), based on the latest available Proof of Reserves (PoR) data as of October 28, 2026. A new PoR snapshot was taken at 00:00 UTC on October 31, and zero-knowledge proof (ZKP) computation began. The updated report was expected to be available on Binance's PoR website the following day.

North Korean Actors Behind The Cyberattack

The Federal Bureau of Investigation (FBI) has linked the Democratic People's Republic of Korea (North Korea) to the theft of more than $6 billion worth of digital assets. The agency refers to this specific North Korean malicious cyber activity as "TraderTraitor". In an earlier press release, the FBI stated that it had worked with the US Secret Service (USSS) and the Internal Revenue Service's Criminal Investigation division (IRS-CI) to trace the stolen virtual assets.

It said, "TraderTraitor actors first converted stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages." The FBI advised virtual asset service providers, including THORNode operators and RPC node operators, to block transactions associated with TraderTraitor actors, warning that they could attempt to launder the stolen assets through these services.

What Is Binance And How Does It Operate?

Binance is not a traditional bank. It is a centralised cryptocurrency exchange (CEX) and digital asset infrastructure provider. It operates as a Virtual Asset Service Provider (VASP) and financial services intermediary in jurisdictions where it is authorised to do so. It acts as a trading platform and custodian for digital assets, facilitating cryptocurrency spot trading, derivatives, crypto transfers and Web3 ecosystem services.