Customers pulled more than $4.6 billion from Binance after cybercriminals stole $6.3 billion in digital currency from the cryptocurrency exchange. The FBI linked the perpetrators to North Korea, while Binance said it would use its own funds to cover the full amount lost in the attack.
In a social media post, Binance said customers had also deposited slightly more than $1 billion after withdrawals for Bitcoin, Ethereum and other cryptocurrencies resumed on Sunday. Taking those deposits into account, the company reported a net outflow of $3.64 billion, with the money leaving the exchange exceeding the amount customers put in.
Binance, which has more than 300 million users and is the world's largest cryptocurrency exchange, sought to put the withdrawals in the context of its overall holdings. The company said the value of cryptocurrency being withdrawn amounted to 2.1% of its total assets, which it placed at $171 billion.
Cofounder Yi He addressed the company's response in a post on X early Monday. "Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds, and Binance can resume operations," she said. Binance did not immediately respond to a request for comment.
About $3 billion of the assets taken in the theft had been frozen, according to Binance. Freezing cryptocurrency gives certain token issuers the ability to prevent those tokens from being transferred anywhere in the world. The company reported the frozen assets alongside its commitment to cover the losses with company funds.
The FBI said Saturday that the hacking group believed to have carried out the theft, known as TraderTraitor, was converting most of the stolen assets into Ethereum. The bureau described those conversions as an effort to conceal the group's tracks following the attack on Binance.
According to the FBI, TraderTraitor also carried out the February 2025 attack on cryptocurrency exchange Bybit that caused a $1.5 billion loss. After the Binance theft, the bureau urged private-sector entities to block transactions involving, or originating from, addresses the group was using to launder the stolen assets.
Binance said early Sunday morning that it had covered approximately 95% of the affected amount. Its pledge extended to the full losses from the theft.
