Daijiworld Media Network - New Delhi
New Delhi, Nov 2: Cryptocurrency exchange Binance witnessed an initial surge in customer withdrawals after resuming services for several digital assets on Sunday, as it scrambled to restore confidence following a massive cyberattack that resulted in the theft of approximately $6.3 billion in cryptocurrency. The FBI has attributed the attack to a North Korean state-sponsored hacking group.
The world's largest cryptocurrency exchange said it had covered around 95 per cent of the stolen assets using company funds and that withdrawal activity was gradually stabilising after an initial spike.
The cyberattack, believed by analysts to be one of the largest financial thefts in history, has raised fresh concerns about security in the cryptocurrency industry. The volume of withdrawals following the reopening is being closely watched as an early indicator of customer confidence in the exchange.
According to cryptocurrency analytics platform DefiLlama, Binance recorded more than $3.5 billion in net outflows on Sunday. The exchange did not comment on the figures.
A Binance spokesperson said withdrawal volumes had surged initially but were subsequently declining towards normal levels.
"Withdrawal volumes spiked at the beginning, however we are seeing a sharp downward trend and withdrawal levels are stabilising to what we would consider normal and expected on-chain activity," the spokesperson said in an emailed statement.
The spokesperson added that withdrawals represented a very small proportion of the company's assets under management. Deposits were also significant, and market conditions remained stable, the exchange said.
Binance resumed withdrawals in phases, prioritising cryptocurrencies according to customer demand over the previous week. The first phase covered 15 digital assets, including Bitcoin, Ether, certain USDC and USDT stablecoin networks and Dogecoin.
The exchange said the phased restoration was intended to ensure the safe resumption of services while addressing customer requirements.
Binance announced earlier on Sunday that it had covered approximately 95 per cent of the stolen cryptocurrency by using company funds to purchase replacement tokens. The remaining five per cent consists of less-liquid assets that may take longer to acquire in the required quantities.
The FBI on Saturday identified a North Korean state-sponsored cyber unit known as TraderTraitor as responsible for the October 29 attack.
According to the agency, investigators observed members of the group converting stolen cryptocurrency primarily into Ether. The FBI warned that further laundering could take place through decentralised finance platforms and instant-swap services.
North Korea has repeatedly denied allegations that state-linked cyber units are involved in espionage, financial theft or revenue generation. Its diplomatic mission in Geneva and embassy in China did not respond to requests for comment.
Blockchain analysis firms TRM Labs and Chainalysis had also linked North Korea to the attack. Their investigations indicated that most of the theft took place within approximately 20 minutes late on Thursday, bearing similarities to previous major cyberattacks attributed to North Korean hackers.
However, US President Donald Trump said on Saturday that Washington had not established North Korea's involvement with certainty.
"We don't know if it's North Korea - but if it is, we'll talk to North Korea about it," Trump told reporters, according to comments posted by a White House account on X.
Binance has been working with cryptocurrency industry partners, law enforcement agencies and blockchain investigators to trace and freeze the stolen assets. The company said approximately $3 billion worth of affected cryptocurrency had been located by Friday.
The exchange has repeatedly assured customers that it would bear the entire financial impact of the breach and that users would not lose their funds because of the attack. It has internally set aside approximately $6.34 billion to cover the losses.
The replacement purchases have been financed through multiple sources, including Binance's $1 billion Secure Asset Fund for Users (SAFU), its Futures Insurance Fund and corporate treasury.
SAFU is a reserve maintained by the exchange to protect customers against financial losses arising from security incidents. Co-CEO Yi He said on Saturday that the company would utilise 50 per cent of its SAFU funds for the recovery effort while replenishing the reserve to approximately $1 billion.
The exchange's other co-CEO, Richard Teng, described the breach as a complex cyberattack involving a compromised laptop and malicious software designed to erase evidence of its activities, making the investigation more difficult.
The attack had already unsettled cryptocurrency markets, with prices falling on Friday as Binance worked to reassure customers about the safety of their holdings.
Founded in 2017, Binance has grown into the world's largest cryptocurrency exchange by trading volume. According to its 2025 annual report, the platform had 335 million registered users globally and approximately $162.8 billion in assets under custody.
Binance founder Changpeng Zhao also thanked the FBI for its assistance after the agency publicly attributed the attack to North Korea's TraderTraitor group.
Zhao said US law enforcement agencies had provided crucial assistance in tracking and freezing stolen cryptocurrency, helping limit the wider impact of the incident.
"A tweet can't fully express our gratitude. Many crypto bros may not realize, a lot of the 'why bitcoin didn't drop more?' credit goes to them," Zhao wrote on X.
Zhao was previously convicted in the United States for failing to maintain an effective anti-money laundering programme at Binance. He was later pardoned by Trump last year.
The latest breach has renewed concerns over the vulnerability of major cryptocurrency exchanges and the growing sophistication of cybercriminal groups targeting digital financial platforms.