Binance customers took out a net $3.64 billion on Nov. 1, the day the exchange began restoring withdrawals after the hack that affected $6.3 billion in assets. Binance says the outflow equals 2.1% of its $171 billion in assets under management. The FBI has said North Korea was responsible for the theft.
How the first day of withdrawals went
Binance said it began restoring withdrawals in phases at 06:00 UTC on Nov. 1, 2026. By 12:36 UTC, withdrawals had resumed on all 15 networks and assets in the initial phase. Between 06:00 and 15:30 UTC, the exchange processed $4.649 billion in withdrawals and $1.01 billion in deposits.
"After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial," Binance wrote on X.
The 2.1% figure is based on its Proof of Reserves data as of Oct. 28. A new snapshot was taken at 00:00 UTC on Oct. 31, and the exchange said an updated report was due the next day.
Changpeng Zhao, Binance's former chief executive, posted his own reading 12 hours in.
"2.1% net outflow, with most occurring in the first couple of hours," he wrote. "98% choose to stay!"
12 hours after withdrawals resumed: 2.1% net outflow, with most occurring in the first couple of hours. Over $1 billion in flow, too.
— CZ 🔶 BNB (@cz_binance) November 1, 2026
98% choose to stay!
Trust isn’t earned by what you say in good times. It’s earned by what you do in hard times.
Thank you for your trust!… https://t.co/r3f6s9c2fy
Zhao no longer runs the exchange but remains a major shareholder.
Binance has faced a run before. After FTX collapsed in November 2022, customers pulled billions from the exchange within days, and it kept paying out.
Where the replacement money came from
Binance says it has covered about 95% of the stolen assets and that the rest may take longer to source. It said it had reserved more than $6.3 billion to deal with the fallout. According to the BBC, the exchange replaced customer assets using its corporate treasury, its futures insurance fund and its emergency reserves.
"Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident," the company said.
The exchange has said early checks pointed to a compromised engineer's laptop as the starting point. It later said it had found additional points of breach. The hack hit Binance.com, and the US-facing platform has said it was not affected.
The FBI names TraderTraitor
The FBI Cyber Branch said North Korea was "responsible for the theft of more than $6 billion USD in virtual assets" from Binance on or about Oct. 29. It calls the specific activity "TraderTraitor," a group also known as the Lazarus Group. The same group stole $1.5 billion from Bybit in 2025.
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n
— FBI Cyber Branch (@FBICyberBranch) October 31, 2026
The FBI, working with the Secret Service and IRS Criminal Investigation, said the actors are converting stolen assets mainly into Ether. It expects the funds to move through DeFi and instant swap services before further laundering. The agencies asked private companies such as THORNode operators and instant exchanges to block transactions with or derived from the addresses the group uses. The FBI published a list of those addresses on Saturday.
THORNode operators run THORChain, a cross-chain swap network that does not have a central operator who can easily halt trades. After the Bybit theft, researchers reported that the attackers pushed large amounts of stolen Ether through THORChain, which drew heated debate within the community over whether the network should have blocked them.
Laundering is still active
Alec Zebrick, a senior manager in global services at Chainalysis, told the BBC's Today Programme that the firm is working with Binance and governments to recover the money. "We continue to see funds being laundered quite actively," he said.
"The attackers are layering these funds across many thousands of addresses, across thousands of deposits," Zebrick added.
Layering means splitting stolen funds into many small transfers so investigators cannot follow one clear path. It is a standard step in laundering, and the high number of addresses makes each freeze harder.
Binance said its team is still testing the remaining networks and assets, and it will announce the next phase of withdrawals once that work is done.
Gunel Ismayilova
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
