Binance began restoring customer withdrawals Sunday after hackers drained over $6 billion in the biggest cyber theft ever recorded, as the crypto industry awaits answers on the breach blamed on North Korea and steps to strengthen the exchange’s defenses.
The world’s largest digital-asset platform reopened Bitcoin withdrawals after 2 p.m. Singapore time, more than two days after halting them following the breach. By evening in Asia, the exchange had seen some $3.5 billion in net outflows, according to DefiLlama data. Co-Chief Executive Officer Yi He said on X some transfers are between Binance wallets.
The first phase of withdrawals covers 15 tokens, including Ether and the two biggest stablecoins, Tether’s USDT and Circle Internet Group Inc.’s USDC, Binance said on X. Withdrawals on 15 blockchain networks including Ethereum, BNB Smart Chain, XRP and Base resumed by around 8:30 p.m. in Singapore, according to the company.
Read more: Binance’s $6.3 Billion Hack: How Crypto Insurance Works
Binance dwarfs its industry rivals, with roughly $132 billion in assets, compared with about $29 billion at the second-largest exchange OKX. “We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened,” Binance said.
Quantitative trading firm SQS Trading has about a quarter of its trading capital on Binance, and is cutting that by roughly a third, according to founder Eli Williams, who added that it won’t flatten positions or reduce usage of the exchange as a venue for hedging. “It’s hard to forecast what the net impact will be at this point but we will be monitoring capital outflows and volume impact relative to other major venues,” Williams said.
Others are holding off any changes. Justin d’Anethan, head of research at Arctic Digital, a private markets advisory firm, said he’s not fazed by the hack. “When something seems fishy, it’s good to act fast; but when something catastrophic happens, it’s better to hold off doing anything,” he said. “I haven’t and wouldn’t move away from Binance.”
A spokesperson for Binance said the withdrawal volumes “spiked at the beginning,” but are now stabilizing to what the company considers normal activity, and a small percentage of its overall assets under management.
The restart tests Binance’s promise to make customers whole following a theft four times the size of the previous record crypto hack at Bybit in 2025. The US Federal Bureau of Investigation said on Saturday the Binance attack was carried out by TraderTraitor, an elite North Korean hacking unit it also held responsible for the roughly $1.5 billion Bybit theft.
The market fallout appears relatively contained, with most major cryptocurrencies seeing a change of less than 1% Sunday. Bitcoin, which accounts for about 60% of the sector’s market value, was trading around $78,000, about 5% below its Thursday high before the attack.
“On some level, this shows how much the industry has matured,” said Haseeb Qureshi, managing partner at venture fund Dragonfly. “We saw extraordinarily quick responses.”
Binance said it has so far replaced about 95% of the stolen cryptocurrency using its corporate treasury, emergency funds and insurance funds. The funds drained in the attack were a mix of the largest cryptocurrencies across 10 blockchains, including Bitcoin and Ethereum.
“Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds,” it said. “These losses will not be passed on to users.”
The exchange is able to cover the losses as a result of its ongoing investment of revenue into cryptocurrencies, Binance co-Chief Executive Officer Richard Teng said in a video posted on social media on Friday. Yi He said Binance’s revenue for this year would completely cover the amount lost.
The ultimate cost to Binance remains unclear. The exchange said about $3 billion in affected assets had been frozen as of Friday, though that does not mean they have been recovered.
Read more: Record Binance Hack Shows No Crypto Firm Is Too Big to Breach
A spate of attacks this year on crypto firms and the broader financial industry has heightened concerns that artificial intelligence is making hackers more effective. Some security experts believe North Korean hackers have incorporated AI tools into their arsenal, helping especially with reconnaissance and social engineering.
Along with the FBI, blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have all pointed to hackers in North Korea as the culprits in the Binance attack.
The attacks have exposed security weaknesses as the crypto industry pushes into mainstream finance. Hundreds of millions of dollars were drained from Bitget in September. Hackers also stole more than $100 million in Bitcoin from wallets secured by Coinkite Inc. devices, while tampering involving Ledger devices led to millions of dollars in losses.
Other recent cyberattacks have hit prediction market Polymarket, South Korean financial firms Mirae Asset Global Investments and Daishin Securities, as well as Japanese currency trading platform GMO Internet Group Inc.
Yi and Teng on Friday confronted the potential reputational damage the attack could do. In a video posted on X, Yi promised Binance would continue to work with law enforcement to find the attackers. The company has vowed to reimburse any users who lost funds in the hack.
“We won’t let the hackers take away the momentum this industry deserves,” she said in her video post, speaking in Mandarin. “Of course, there are areas where we could have done better. We should have invested more in security earlier, and set stricter standards. Going forward, we won’t hold back, whether it’s investing in security or fighting hackers.”
Binance established an emergency reserve called the Secure Asset Fund for Users, or SAFU, in 2018 as a backstop for customers in “extreme situations,” according to the exchange. SAFU is generally maintained at around $1 billion, but has fluctuated in the past in tandem with market movements, Binance said in 2024.
Binance said earlier that the incident may involve a compromised software engineer’s laptop, as well as “additional points of breach.” It found no evidence of leaked private keys, it said.
Photograph: The Binance logo on a smartphone arranged in Gyeongsan, South Korea, on Friday, Oct. 30, 2026; photo credit:: SeongJoon Cho/Bloomberg