Binance sees spike in customers pulling funds out after covering bulk of stolen $6.3 billion

By Shubham Kalia and Kanjyik Ghosh

Nov 1 (Reuters) - Binance saw an initial spike in customers pulling money out after the exchange resumed withdrawals for a number of assets on Sunday, as it tries to recover from the theft of $6.3 billion in tokens from its platform in a hack the FBI and analysts have tied to North Korea.

Binance said it had now covered 95% of the stolen assets. It said after an initial spike, withdrawals were stabilizing. 

The heist, which analysts believe may be the biggest financial robbery ever, adds to a string of recent crypto thefts, and the pace of withdrawals is an early test of whether customers trust the exchange with their money after the attack. Last year, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs.

A Binance spokesperson said in an emailed statement: “Withdrawal volumes spiked at the beginning, however we are seeing a sharp downward trend and withdrawal levels are stabilising to what we would consider normal and expected on-chain activity."

The spokesperson said the withdrawals represented a very small percentage of assets under management. 

"Deposits are also significant. We will keep you updated. Rest assured that market conditions are stable,” the spokesperson said. 

The world's biggest cryptocurrency exchange recorded more than $3.5 billion in net outflows on Sunday, crypto analytics platform DefiLlama said on its dashboard. Binance did not comment on the DefiLlama data.

Binance, which was founded in China, said the rollout for withdrawals would be carried out in phases, prioritising user demand. The first phase covered 15 tokens including bitcoin, ether and those involving some USDC and USDT stablecoins and dogecoin. 

"We are taking a phased approach by prioritizing tokens based on the past week data of user demand," Binance said in an earlier article posted on X.

Binance said earlier on Sunday that it had covered $6 billion of stolen cryptocurrencies by using company money to buy replacement tokens. The remaining 5% of stolen tokens consist of assets that are less liquid and may take longer to source in the required amounts, according to the exchange.

FBI TIES ATTACK TO NORTH KOREAN UNIT

The FBI said on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack.

Pyongyang has for years denied using state-linked cyber units for espionage, financial theft and revenue generation. Its mission in Geneva and embassy in China did not respond to requests for comment.

Law enforcement observed members of the unit converting stolen assets into the cryptocurrency ether, the FBI said in a statement, adding that it expected "further laundering" of the assets through the use of related technology.

Analysts had also blamed North Korea for the heist.

The bulk of the theft unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.

US President Donald Trump, however, said on Saturday it remained unclear whether North Korea was involved.

"We don't know if it's North Korea — but if it is, we'll talk to North Korea about it," Trump told reporters on Saturday in comments posted by a White House account on X.

BINANCE VOWS TO BEAR FINANCIAL COSTS

Binance has been working with industry partners to freeze some of the affected assets, with about $3 billion located as of Friday, it said.

The exchange has repeatedly said it would bear the financial impact of the funds stolen in the hack. It has set aside around $6.34 billion of company funds internally to cover the losses. 

The money spent buying replacement tokens came from Binance's $1 billion Secure Asset Fund for Users (SAFU), a bitcoin reserve it holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and its corporate treasury, it said on X.

Co-CEO Yi He said on Saturday that Binance would use 50% of its SAFU funds, while the company committed to replenishing the fund to about $1 billion.

Richard Teng, the other co-CEO, has said that the breach was a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate.

Crypto prices fell on Friday, while Binance sought to reassure customers that their funds were safe after the hack.

Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about $162.8 billion in assets under custody as of its 2025 annual report.

BINANCE FOUNDER THANKS US LAW ENFORCEMENT

In a post on X that quoted the FBI statement on North Korea’s involvement, Binance founder Changpeng Zhao thanked the agency for its support. Binance did not respond to a request for comment on North Korea's involvement.

Zhao, who was convicted in the US of failing to maintain an effective anti-money laundering program before being pardoned by Trump last year, said US law enforcement agencies provided vital help, including by tracking and freezing the stolen assets. 

"A tweet can't fully express our gratitude. Many crypto bros may not realize, a lot of the 'why bitcoin didn't drop more?' credit goes to them," Zhao wrote, referring to US law enforcement agencies.

(Reporting by Shubham Kalia in Bengaluru, Kanjyik Ghosh in Barcelona and Hannah Lang in New York; Additional reporting by Sathvi G Bhat, Angela Christy, Elizabeth Howcroft and Max Cherney; Editing by Sumeet Chatterjee, Megan Davies, William Mallard and Joe Bavier)