Binance users withdraw $3.6bn after largest-ever crypto hack

Users withdrew billions because Binance had just suffered a major cyber-attack affecting $6.3bn in digital assets. Even though the company promised to cover customers’ losses, users had a strong reason to reduce their exposure while security checks and recovery efforts continued. A withdrawal is also a direct way to regain control of assets after an exchange breach.

Binance processed $4.649bn in withdrawals and $1.01bn in deposits between 06:00 and 15:30 GMT on November 1. The difference produced a net outflow of about $3.64bn. Binance described an initial spike, followed by declining withdrawals and stabilising activity.

The outflow was large in dollars but represented just over 2% of Binance’s $171bn under management. More cryptocurrency withdrawals resumed, while other services were scheduled to return in phases after security checks. Continued laundering of stolen funds could keep confidence under pressure.

A net withdrawal measures the difference between money leaving an exchange and money entering it. It shows the overall direction of funds after deposits are subtracted. This matters because the total amount withdrawn can be much larger than the net loss of assets held on the platform.

Binance reported $4.649bn in withdrawals and $1.01bn in deposits between 06:00 and 15:30 GMT on November 1. Subtracting deposits from withdrawals gives an approximate net outflow of $3.64bn. Therefore, $3.6bn describes the balance after both flows, not the full withdrawal activity.

The figures show intense movement in both directions as Binance reopened. Users were taking assets out, while others were still depositing them. Binance said the initial withdrawal spike declined and stabilised, suggesting the immediate rush eased, though the exchange continued restoring services in phases.

The incident was enormous in absolute terms: it impacted $6.3bn worth of digital assets. Binance also reported a $3.64bn net outflow when customers withdrew more than they deposited after the exchange reopened. Comparing these figures shows both the attack’s financial scale and the immediate reaction from users.

Binance said it managed about $171bn in assets. The reported net withdrawal was just over 2% of that total, so most assets remained on the platform at that point. The hack’s affected assets and the post-reopening outflow are different measures: one describes the incident, while the other describes customer activity.

Binance said it had reserved more than $6.3bn and had covered around 95% of the stolen assets. It also promised to cover all losses linked to the attack. More services were due to resume gradually after security checks, while investigators continued tracking laundered funds.

A work laptop can connect an employee to sensitive exchange systems. If attackers compromise it, they may obtain login details, session access, or other information that helps them reach transaction controls. The danger is not the laptop alone, but the access and authority connected to it.

Binance said early checks suggested the incident may have started with an engineer’s compromised laptop. The hackers apparently used that foothold to find a way to make unauthorised transactions. In a cryptocurrency exchange, such transactions can move digital assets rapidly once the relevant controls are bypassed or misused.

The article does not identify the exact technical weakness or explain precisely how the attackers approved each transfer. Binance suspended all transactions after the incident and resumed services in phases. It said security checks had to be completed before more services could return, showing why one compromised device can trigger wider restrictions.

When stolen assets cannot be recovered immediately, customers face uncertainty about whether their balances will be restored and when normal services will return. The exchange must investigate the breach, secure its systems, and find replacement funds. This can also cause temporary limits on withdrawals or other transactions.

Binance said it had covered around 95% of the stolen assets using its corporate treasury, futures insurance, and emergency reserve funds. It repeatedly promised to cover the full financial impact. Meanwhile, Alex Zebrick of Chainalysis said the attackers were actively laundering funds, making recovery more difficult.

The immediate customer response was significant: users withdrew about $3.64bn more than they deposited after reopening. Binance said this was just over 2% of its managed assets, and withdrawals later stabilised. Continued recovery efforts and phased service resumptions may help, but unresolved losses and laundering can continue to test confidence.

Laundering cryptocurrency means making stolen funds harder to trace or recover. Attackers can divide the assets, move them between many wallet addresses, and use numerous deposits to create a complicated transaction trail. This process is called layering in the article’s description.

Alex Zebrick of Chainalysis said the attackers were layering funds across many thousands of addresses and thousands of deposits. The movements spread the stolen cryptocurrency through a large network rather than leaving it in one obvious wallet. That makes investigators’ work harder and can delay recovery.

Blocking remains possible because wallet addresses linked to the theft can be identified and circulated. The FBI published a list of addresses linked to the alleged North Korean group and urged industry partners to block transactions involving them. Binance also urged cryptocurrency issuers to freeze affected assets, though the article does not state how much was ultimately blocked.

A centralised cryptocurrency exchange is an organisation that provides a managed marketplace for buying, selling, depositing, and withdrawing digital assets. Users depend on the company’s computers and security systems to record balances and process transfers. This convenience also creates concentration risk: a problem at the exchange can affect many customers at once.

Binance’s global platform, Binance.com, was the centralised exchange hit by the attack. The company suspended transactions, checked its systems, replaced customer assets using several funding sources, and reopened withdrawals in phases. These actions show how the exchange acts as the operational gatekeeper for customer activity.

Customers rely on Binance to keep services available and protect assets from unauthorised transactions. The article notes that cryptocurrencies are digital assets managed on computers, smartphones, and other devices. After the breach, users withdrew about $3.64bn more than they deposited, showing how quickly confidence can influence activity on a centralised platform.