Binance recorded $3.6 billion in net customer outflows after reopening withdrawals following a massive cryptocurrency theft reportedly linked to North Korea, raising concerns about exchange security.
Binance, the world's largest cryptocurrency exchange, has reported significant customer withdrawals following a major security breach involving the theft of $6.3 billion in digital assets. Customers reportedly withdrew approximately $3.6 billion after the platform resumed withdrawal services on November 1, 2026.
The exchange had temporarily suspended transactions following the incident. Although Binance has gradually restored withdrawals, the large outflow highlights concerns among customers about the safety of their funds.
The theft has reportedly been linked to North Korea, which has been accused of targeting cryptocurrency platforms and businesses through sophisticated cyberattacks.
According to media reports, Binance experienced substantial withdrawals after reopening its services following the security incident on Thursday.
The company announced on X that it began restoring withdrawals in phases at 06:00 UTC on November 1, three days after freezing assets in response to the theft.
During the initial phase, withdrawals were restored across all 15 networks and supported assets included in that phase.
Binance reported that customers deposited approximately $1.01 billion in assets while withdrawing around $4.649 billion. Most of these transactions took place during the first few hours after services resumed.
As a result, the exchange recorded net outflows of approximately $3.64 billion.
According to Binance, this amount represented around 2.1 per cent of its total assets under management, which stood at approximately $171 billion.
Following the initial surge in withdrawals, Binance said transaction volumes had started declining and were moving towards expected levels. Deposit activity also remained substantial, according to the company's update.
The exchange stated that its technical teams were continuing to test the remaining networks and assets before restoring additional services.
Binance also assured customers that it was prioritising the safe and reliable restoration of access to their funds. The company said it would share information about the next phase of the process once the necessary checks were completed.
The update was intended to address concerns about the platform's operational stability following the security breach.
Binance has reportedly assured customers that it will cover all losses resulting from the incident. According to a report by The New York Times, the company also worked with other cryptocurrency businesses to freeze approximately $3 billion worth of stolen assets.
The recovery effort highlights the role of cooperation between cryptocurrency exchanges and other industry participants in responding to large-scale security incidents.
However, freezing stolen assets does not necessarily mean that all the affected funds have been recovered. The investigation and efforts to trace the remaining assets may continue.
Cybersecurity analysts and the Federal Bureau of Investigation (FBI) have reportedly attributed the theft to North Korea, according to The New York Times.
North Korean-linked hacking groups have been accused of targeting cryptocurrency exchanges and other digital asset businesses over several years. These attacks often exploit security weaknesses in digital infrastructure to steal funds.
The latest incident has once again raised concerns about the growing sophistication of cyberattacks targeting the cryptocurrency industry.
The attack may also have involved artificial intelligence technology to speed up certain operations.
According to the New York Times report, cryptocurrency analytics firm Chainalysis suggested that AI could have helped attackers process thousands of transactions within a short period.
The reported use of AI in the incident highlights how advanced technologies could potentially be misused to accelerate cybercrime. However, the precise role of AI in the attack has not been independently established in the information provided.
Binance co-founder Changpeng Zhao addressed the importance of customer confidence following the incident. He said that trust is demonstrated through actions during difficult situations rather than statements made during periods of stability.
His remarks came as the exchange faced the challenge of reassuring customers after the theft and the temporary suspension of withdrawals.
According to The New York Times, Zhao also warned users about online scammers making false promises of compensation. Such scams can target customers who are already worried about losing access to their cryptocurrency holdings.
Customers have therefore been advised to remain cautious about unsolicited messages and unofficial recovery offers.
Conclusion
The reported $6.3 billion cryptocurrency theft and subsequent $3.6 billion net outflow have placed Binance under significant scrutiny. While the exchange says it will cover the losses and has helped freeze around $3 billion in stolen assets, restoring customer confidence remains a major challenge. The incident also highlights the growing cybersecurity risks facing the global cryptocurrency industry.