Photo: Collected
Customers withdrew $3.6 billion from Binance, the world’s largest cryptocurrency exchange, soon after it resumed trading yesterday (Sunday). It was the company’s first return to trading since it suffered the biggest cyberattack in cryptocurrency history.
Binance had temporarily suspended all trading after the attack. The company lost $6.3 billion in the attack. Several major organisations, including the US Federal Bureau of Investigation (FBI), have blamed North Korea for the attack.
Binance said the shortfall of about 95 percent of the stolen assets has been covered; it may take more time to raise funds equivalent to the remaining assets. The company has repeatedly said it will bear all financial losses from the attack itself.
Binance said on social media platform X that it processed withdrawal requests worth $4.649 billion between 6am and 3:30pm Greenwich Mean Time on 1 November. Deposits of $1.01 billion came in during the same period. In net terms, therefore, about $3.64 billion left the company.
The company further said that although withdrawals surged at first, they later eased and are stabilising as expected. Sunday’s net withdrawals amounted to slightly more than 2 percent of the $171 billion in assets managed by Binance.
Last week Binance said it had set aside funds of more than $6.3 billion to handle the aftermath of the attack. Withdrawals of more than two dozen major cryptocurrencies, such as Bitcoin and Ethereum, have also resumed. The remaining services will be restored in phases after security checks.
Alex Zerden, a senior investigator at blockchain analytics firm Chainalysis, said money linked to the attack is still being laundered through various channels. He is working with the company and various governments to recover the stolen money.
Speaking on the BBC’s Today programme, Alex Zerden said, ‘We are still seeing money being laundered quite actively. The attackers are splitting the money and sending it to thousands of addresses. There is an attempt to hide the source of the money through thousands of deposits.’
The attack is being blamed on a North Korean cybercrime group called TraderTraitor, also known as the Lazarus Group. In 2025 the group stole $1.5 billion from crypto exchange Bybit; at the time it was the biggest theft in the cryptocurrency sector.
On Saturday the FBI published a list of cryptocurrency wallet addresses linked to the group. The agency also urged partner organisations to block transactions from these addresses.
Binance quickly contacted various cryptocurrency issuers to freeze the affected crypto assets.
Last week the company said a preliminary investigation suggested the incident began with the hacking of an engineer’s laptop. Taking advantage of unauthorised access to that laptop, the hackers found a way to make illegal transactions.
Cryptocurrencies are bought and sold on various exchange platforms such as Binance. Cryptocurrency is a type of digital asset; unlike cash, it has no physical existence. These assets are managed and traded on computers, smartphones and other digital devices. Founded in China, Binance has several billion registered users worldwide.
Background
Reporting an AFP story, the Oman Observer said on 30 October that Binance acknowledged the attack that day (Friday), saying the loss was about $6.3 billion and could rise further. The company also said it had frozen assets worth about $3 billion. Blockchain analytics firm TRM Labs blamed the North Korea-linked TraderTraitor for the attack with ‘high confidence’.
By the numbers
In an alert on 26 February 2025, the US Federal Bureau of Investigation (FBI) said virtual assets worth about $1.5 billion were stolen from Bybit on or around 21 February that year. The agency blamed North Korea for it.
Sources
Original report: Ajker Patrika
Background sources: Oman Observer (AFP), 30 October 2026; FBI (IC3), 26 February 2025
