Customers have withdrawn a net $4.72 billion from Binance following a record $6.3 billion cryptocurrency theft, as the world's largest digital asset exchange attempts to restore confidence and demonstrate that customer balances remain protected.
The withdrawals followed the reopening of services after a cyberattack on October 29 forced Binance to suspend transactions for more than two days.
Reuters reported on Monday, November 2, that the outflows represented approximately 3% of the assets held on the platform.
Binance says withdrawal activity is stabilising and that it has replenished approximately 95% of the assets affected by the theft.
The company has pledged to absorb the financial losses rather than pass them on to customers.
The incident has intensified concerns about cybersecurity across the cryptocurrency industry, particularly as digital assets become increasingly connected to mainstream financial markets.
What happened at Binance?
Binance disclosed that its hot wallets were compromised at approximately 20:05 UTC on October 29.
Hot wallets are cryptocurrency storage systems connected to the internet, allowing exchanges to process transactions more quickly than they could using offline storage.
That accessibility also creates potential exposure to cyberattacks.
Binance initially said its investigation suggested that attackers may have compromised a software engineer's laptop and gained access to systems used to process withdrawals.
Subsequent investigations identified additional potential entry points.
The company has not yet published a complete independently verified technical account of how the attackers breached its systems.
It has said there is no evidence that wallet private keys were exposed.
The estimated theft of $6.3 billion makes the incident one of the largest cryptocurrency security breaches ever reported.
FBI attributes attack to North Korean hackers
The United States Federal Bureau of Investigation publicly attributed the theft to North Korea-linked cyber actors known as TraderTraitor.
In an October 31 alert, the FBI said the group was responsible for stealing more than $6 billion in virtual assets from Binance.
The agency said investigators had observed stolen cryptocurrency being converted into Ethereum and warned that the funds could be moved through decentralised financial services and rapid exchange mechanisms.
The FBI urged cryptocurrency businesses and blockchain infrastructure operators to help identify and block transactions associated with the stolen assets.
The attribution is an official US law-enforcement assessment.
It should not be confused with a completed criminal trial or judicial finding against identified individuals.
North Korea has previously faced allegations from international authorities concerning cryptocurrency thefts intended to generate revenue.
The full investigation into the Binance incident remains ongoing.
FBI
Customers withdraw billions
After Binance began reopening withdrawals on Sunday, customers moved substantial amounts of cryptocurrency away from the platform.
Reuters reported net withdrawals of $4.72 billion.
Binance said the outflows represented approximately 3% of assets held on the exchange.
The company also reported $2.7 billion in customer inflows since services began reopening, indicating that some users continued depositing funds.
The $4.72 billion figure is a net outflow and should not be added to the separately reported inflows as though they represented additional losses.
Analysts interviewed by Reuters said the withdrawal activity had not yet developed into a wider financial panic.
Some traders moved assets into personal wallets or other exchanges, while others retained their accounts.
The figures nevertheless illustrate the pressure that a major security breach can place on customer confidence.
Binance says 95% of assets have been replenished
Binance has committed company resources to replacing the cryptocurrency stolen during the attack.
The exchange says it has drawn on corporate treasury funds, insurance resources and reserves established for customer protection.
In its fifth recovery update, published on November 2, Binance said approximately 95% of the affected assets had been replenished.
The remaining 5% consists primarily of less-liquid tokens that are more difficult to acquire in large quantities.
The company says it is continuing to purchase those assets.
Importantly, replenishing customer asset balances is not the same as recovering all stolen cryptocurrency from the attackers.
Binance is using its own resources to cover losses while law-enforcement agencies and blockchain investigators attempt to trace and freeze stolen funds.
The distinction matters because customers may have their account balances restored even while significant amounts of stolen cryptocurrency remain under the attackers' control.
New proof-of-reserves information published
Binance also announced that customers holding 10 major cryptocurrencies could independently verify that their balances were backed at a minimum ratio of one to one.
The assets covered include Bitcoin, Ethereum, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash.
The verification system uses cryptographic techniques, including zero-knowledge proofs, to allow customers to check that their balances are included in the company's published reserve information.
The relevant snapshot was taken on October 31.
Binance says the latest proof has been completed and made available to users.
However, the proof covers specified assets and a particular snapshot date.
It should not be described as independent verification that every financial obligation of the company has been settled or that all stolen funds have been recovered.
The exchange plans to publish another snapshot on November 4, with broader asset coverage.
Investigators attempt to freeze stolen cryptocurrency
Blockchain investigators and stablecoin issuers have been working to restrict the movement of stolen assets.
Reuters reported that approximately half the stolen cryptocurrency was held in stablecoins, some of which had been frozen by their issuers.
Circle said it had frozen more than $1.1 billion in USDC associated with the incident.
Blockchain analytics firm Elliptic estimated that the attackers still controlled approximately $3.28 billion in cryptocurrency, primarily Bitcoin and Ethereum.
Those figures represent assessments at particular points during the recovery operation and may change as assets are traced, frozen or transferred.
The ability to identify transactions on public blockchains can assist investigators.
However, tracing cryptocurrency does not automatically give authorities the power to recover it.
Cross-border cooperation and action by relevant service providers are often required.
Wider implications for cryptocurrency markets
The incident comes at a time when digital assets are increasingly used by individual investors, businesses and financial institutions.
Major cryptocurrency exchanges provide services that resemble parts of traditional financial infrastructure, including custody, payments and trading.
A security breach involving billions of dollars therefore raises questions extending beyond one company.
Investors may reconsider how much cryptocurrency they keep on exchanges rather than in independently controlled wallets.
Financial institutions may also examine their exposure to digital asset custodians and the effectiveness of their cybersecurity arrangements.
Analysts told Reuters that the wider market impact had so far remained limited.
Bitcoin and Ethereum recovered some of their earlier losses over the weekend.
Nevertheless, the scale of the attack demonstrates that large platforms remain vulnerable to sophisticated cyber operations.
Implications for African cryptocurrency users
Cryptocurrency trading and digital asset services have attracted significant interest in African markets, including Nigeria.
The Binance incident highlights the importance of understanding the risks associated with third-party custody.
Customers using an exchange generally depend on the operator's security systems, internal controls and ability to meet withdrawal requests.
A company's promise to reimburse losses may provide reassurance, but users still depend on the company's financial resources and successful implementation of its recovery plan.
The incident does not establish that Nigerian customers suffered losses of any particular amount.
No verified country-specific customer loss figure was identified in the reporting reviewed.
What happens next
Binance plans to restore withdrawal services for additional cryptocurrencies and networks in stages.
It has also promised a more comprehensive technical report explaining how the attack occurred and what measures are being introduced to prevent a recurrence.
Investigators will continue tracing stolen assets and examining the alleged involvement of North Korean cyber actors.
Customers and market observers will be watching whether Binance completes the replenishment of the remaining affected tokens and maintains normal withdrawal operations.
The exchange's latest recovery announcement is an important development, but it does not close the investigation.
The broader significance of the attack lies in the questions it raises about the security of cryptocurrency custody, the speed of digital asset theft and the responsibilities of exchanges holding customer funds.
With billions withdrawn and a substantial amount of stolen cryptocurrency still being traced, the incident remains one of the most consequential cybersecurity events affecting the digital asset industry.
