Customers withdraw $3.6B after largest theft in Binance's history

Binance reopened withdrawals in stages after suspending transactions following the largest theft in its history. The reopening mattered because customers needed access to their assets, but the theft had sharply increased fear about the exchange’s security and reliability.

The company said customers deposited $1.01 billion and withdrew about $4.649 billion. Most activity happened during the first few hours after trading resumed. Withdrawals began at 06:00 UTC on November 1, 2026, and covered all 15 networks and assets in the initial phase by 12:36 UTC.

The resulting outflow was about $3.64 billion, or 2.1% of Binance’s $171 billion in managed assets. Binance said withdrawals later declined and stabilised, while deposits remained substantial. It also promised to cover hack-related losses and continued testing other networks and assets.

Binance is a cryptocurrency exchange, a service where customers can hold, trade, deposit, and withdraw digital assets. The article identifies it as the world’s largest cryptocurrency exchange. Its size means that decisions about access to funds can affect many customers and move large amounts of cryptocurrency.

In this incident, Binance suspended all transactions after the theft. It later restored withdrawals in phases, first covering 15 networks and assets. Customers deposited $1.01 billion and withdrew about $4.649 billion after trading was restored, showing how heavily users rely on an exchange to access their holdings.

An exchange can provide convenience, but customers also depend on its systems and security controls. Binance said it was testing remaining networks and assets, while promising safe access and coverage for losses from the hack. The article does not explain Binance’s full business model or every service it offers.

The outflow was enormous in dollar terms, but it was a relatively small share of Binance’s total assets under management. Binance said customers withdrew about $3.64 billion after withdrawals reopened. The figure shows the scale of customer concern following the theft.

Binance reported $171 billion in total assets under management. Dividing the $3.64 billion outflow by that total gives the company’s stated proportion: 2.1%. Customers also withdrew about $4.649 billion and deposited $1.01 billion, producing the net outflow reported after trading resumed.

The percentage does not mean the event was minor. Billions moved within hours, and the withdrawals tested Binance’s ability to restore access. Binance said withdrawal volumes declined and stabilised, while deposit volumes remained substantial. It also said market conditions were stable and promised to cover losses from the hack.

When an exchange freezes withdrawals after a theft, customers may temporarily lose access to assets they expect to control. That uncertainty can create panic, especially when the exchange has not yet explained the damage or proved that its systems are safe. The freeze can also make customers question whether the platform can protect their funds.

Binance suspended all transactions after the theft, then saw customers withdraw about $4.649 billion once trading resumed. The outflow reached about $3.64 billion after deposits were counted. This illustrates a key mechanism: restricted access builds pent-up demand, and reopening can produce a rapid rush for the exits.

Markets may face pressure if many customers sell or move assets at once. Trust can weaken even if the exchange remains solvent and promises compensation. In this case, Binance said it would cover hack-related losses, worked with firms to freeze about $3 billion in stolen assets, and said conditions were stable.

The theft was attributed by cybersecurity analysts and the FBI to North Korea, according to the report cited in the article. That attribution identifies a suspected state-linked actor, but the article does not describe a public criminal charge or court finding. The theft was linked to North Korea after Binance lost $6.3 billion.

The article says North Korea has targeted cryptocurrency companies for years. It takes advantage of vulnerabilities in their infrastructure to steal digital assets. Chainalysis also said the attackers may have used artificial intelligence to accelerate the attack, processing thousands of transactions in a short period.

This pattern matters because cryptocurrency companies hold or control valuable digital assets and depend on complex technical systems. A weakness can enable very large losses. Binance said it worked with other firms to freeze about $3 billion in stolen assets and would cover all losses caused by the hack.

Cryptocurrency transactions can operate without one central authority, but many users still rely on exchanges and other companies. Those businesses may control customer accounts, monitor transfers, and decide whether to process or restrict activity. This creates practical points where stolen assets can be identified and blocked.

The article says Binance worked with other cryptocurrency firms to freeze about $3 billion in stolen assets. A common mechanism, explained using established industry knowledge, is tracing transactions on public blockchains, flagging addresses linked to theft, and preventing cooperating platforms from accepting or moving those assets. This does not erase transactions already recorded.

The article does not detail exactly how the freeze worked. Its example shows that decentralization does not remove every point of intervention. Cooperation among exchanges, analytics firms, and other businesses can limit how stolen assets are converted or transferred. The effectiveness depends on where the assets move and which firms cooperate.

A blockchain records transactions shared across a network. A cryptocurrency wallet uses a private key to create a digital signature, proving that the person or system authorizing a transfer controls the assets. The network checks that signature and records the transfer if it is valid. These foundational details are established knowledge beyond the article.

The biggest weakness is usually control of the private key or the systems managing it. Attackers may steal keys, trick users into revealing them, exploit software, or compromise an exchange’s infrastructure. If a valid key is used, the network may treat the transfer as authorized. The article specifically says the attackers exploited infrastructure vulnerabilities and processed thousands of transactions quickly.

Blockchain records can make transfers visible, but they generally cannot reverse a completed transaction automatically. Exchanges and other firms may still identify suspicious addresses and restrict related assets. Binance said it worked with firms to freeze about $3 billion, showing how off-chain cooperation can respond to an on-chain theft.