Cryptocurrency exchange Binance is facing a major test of customer confidence after users withdrew a net $3.64 billion from the platform following a record $6.3 billion cyberattack that United States authorities have attributed to North Korean hackers.
The withdrawals occurred during the first nine and a half hours after Binance began restoring services on Sunday, November 1, following a temporary suspension introduced in response to the October 29 theft.
The exchange said the initial surge in withdrawals was slowing and that customer activity had begun to stabilise.
According to figures reported by Reuters on Monday, November 2, approximately $4.6 billion was withdrawn from the platform while $1 billion flowed in through deposits, leaving a net outflow of about $3.64 billion.
That represented approximately 2.1% of Binance's reported $171 billion in assets.
The development marks a significant moment in the cryptocurrency industry's response to one of the largest digital asset thefts ever recorded.
How the $6.3 billion attack unfolded
Binance confirmed that attackers compromised its hot-wallet infrastructure at approximately 20:05 UTC on October 29.
Hot wallets are cryptocurrency storage systems connected to the internet, allowing exchanges to process transactions and withdrawals.
Their accessibility makes them important to everyday operations but also exposes them to potential cyberattacks.
In an official security update published on October 30, Binance said approximately $6.3 billion in cryptocurrency had been removed through unauthorised transactions.
The company initially suggested that a compromised laptop belonging to a technical employee might have provided attackers with access to internal systems.
However, subsequent investigations identified additional points of intrusion.
Binance said it had found no evidence that its wallet private keys had been leaked.
The complete technical sequence of the attack has not yet been publicly established.
The exchange has promised a detailed investigation report after its security teams complete their work.
FBI attributes attack to North Korean hackers
On October 31, the United States Federal Bureau of Investigation publicly attributed the theft to North Korea's TraderTraitor cyber operation.
The FBI said the attackers were converting stolen assets primarily into Ethereum and could attempt further laundering through decentralised financial platforms and cryptocurrency exchange services.
The agency is working with the United States Secret Service and Internal Revenue Service Criminal Investigation to trace the assets.
It has also asked cryptocurrency businesses, blockchain infrastructure providers and other financial technology operators to identify and block transactions linked to addresses associated with the stolen funds.
The attribution represents the FBI's official investigative assessment.
It does not mean that every individual involved has been publicly identified or that the full technical investigation has concluded.
Blockchain security companies have also linked the attack to North Korean cyber operations.
North Korea has previously been accused of conducting large-scale cryptocurrency thefts to generate revenue despite international sanctions.
Binance begins restoring withdrawals
Following the breach, Binance temporarily suspended cryptocurrency withdrawals while engineers investigated the affected infrastructure.
The company subsequently announced a phased reopening beginning on November 1.
Initial restoration covered selected cryptocurrency networks and assets, including Bitcoin, Ethereum, BNB, Solana, XRP and major stablecoins.
Binance said the phased process was necessary to complete security checks and monitor platform stability.
Some withdrawals remained subject to delays or temporary restrictions.
By Monday, November 2, Reuters reported that the exchange had also restored United States dollar cash withdrawals.
However, not every cryptocurrency withdrawal service had returned to normal operation.
Customers were advised to check the status of individual networks and assets before attempting transactions.
Billions leave the exchange
The reopening immediately provided an indication of how customers were responding to the security breach.
Binance reported approximately $4.6 billion in withdrawals and $1 billion in deposits during the initial period.
The resulting $3.64 billion net outflow was substantial in absolute terms, although it represented a relatively small proportion of the exchange's reported asset base.
Binance said withdrawal volumes had declined after the initial surge.
Some analysts interpreted the figures as evidence that the breach had not triggered a widespread loss of confidence.
Others warned that large institutional investors and professional trading firms could reassess their exposure to centralised cryptocurrency exchanges.
The distinction is important.
A customer transferring digital assets from an exchange to a private wallet is not necessarily selling those assets or leaving the cryptocurrency market.
Nevertheless, large withdrawals can place operational pressure on platforms and expose weaknesses in their ability to maintain liquidity and process transactions.
Binance promises to cover customer losses
Binance has pledged that customers will not bear the financial cost of the stolen assets.
The company said it had set aside more than $6.34 billion in corporate and reserve resources to address the breach.
Those resources include its corporate treasury, futures insurance arrangements and Secure Asset Fund for Users, commonly known as SAFU.
By November 1, Binance said it had replenished approximately 95% of the affected cryptocurrency assets.
The remaining 5% consisted largely of less liquid tokens that were more difficult to purchase in the quantities required.
This replenishment is separate from the recovery of stolen cryptocurrency.
Replacing assets using company resources does not mean the original stolen funds have been returned.
Binance has also reported that approximately $3 billion in affected assets were frozen through cooperation with blockchain partners and cryptocurrency issuers.
The frozen amount should not be added to the company's replenishment figures as though the two represented independent completed recoveries.
The exchange has promised further proof-of-reserves information and a technical report on the incident.
Wider cryptocurrency markets react
The attack unsettled digital asset markets, with Bitcoin and Ethereum declining sharply after the initial reports.
Bitcoin subsequently recovered from a six-week low and was trading above $78,000 on Monday, according to Reuters.
Ethereum also recovered from recent losses.
The incident coincided with substantial withdrawals from cryptocurrency investment products.
United States spot Bitcoin exchange-traded funds recorded approximately $643 million in outflows on Friday, while more than $1.3 billion in leveraged cryptocurrency positions were liquidated, according to industry figures cited by Reuters.
These developments indicate heightened investor sensitivity, although not every market movement can be attributed solely to the Binance breach.
The long-term consequences will depend partly on the outcome of the investigation, the exchange's ability to restore services and whether customers regain confidence in its security arrangements.
Why the incident matters for Nigeria and Africa
The attack also has implications for Africa, where cryptocurrency is widely used for investment, international payments and access to dollar-denominated digital assets.
Nigeria is among the continent's most active cryptocurrency markets.
Research cited by Nigerian business publication BusinessDay indicates that the country recorded approximately $92.1 billion in cryptocurrency transaction value during the 12 months to June 2025.
That figure describes the wider Nigerian cryptocurrency market, not funds held specifically on Binance.
The exchange has also faced regulatory disputes in Nigeria, making its global operations particularly relevant to the country's digital asset industry.
For Nigerian users, the incident highlights the risks associated with keeping cryptocurrency on platforms that control the underlying assets and withdrawal infrastructure.
Even where a company promises to reimburse losses, temporary restrictions can affect users who depend on immediate access to funds.
The breach also raises questions about cybersecurity standards, asset custody, consumer protection and the ability of regulators to oversee platforms operating across national borders.
No verified evidence reviewed for this report establishes a specific amount lost by Nigerian Binance customers.
What happens next
Binance is continuing to restore affected services and purchase replacement cryptocurrency assets.
Its investigators are also examining how attackers accessed the exchange's infrastructure and whether additional security weaknesses remain.
The FBI and other agencies are attempting to trace and restrict the movement of stolen funds.
Further proof-of-reserves disclosures and a detailed technical investigation are expected.
The central questions now concern the security of the exchange, the recovery of stolen assets and the durability of customer confidence.
For the wider cryptocurrency industry, the incident is a reminder that the scale of digital finance has grown rapidly, while the challenge of protecting assets against sophisticated cyberattacks remains significant.
Binance has pledged to absorb the financial loss, but the $3.64 billion in net customer withdrawals demonstrates that the consequences of a major breach can extend beyond the money stolen.
They can also affect trust in the institutions responsible for safeguarding digital assets.
