Binance faces $3.6bn in withdrawals after historic North Korean cyberattack

Binance customers pulled out roughly $3.6 billion in net funds after the trading platform reopened operations following an unprecedented cyberattack, according to company statements reported by the BBC. The breach compromised approximately $6.3 billion in digital currency, making it the most severe theft the sector has ever seen.

The exchange halted all user activity immediately after discovering the breach. Once trading and cash-outs restarted on Sunday, users initiated $4.65 billion in withdrawals against $1.01 billion in incoming deposits over a span of nine and a half hours, creating an outflow spike that company officials noted later began to level off. Binance stated that the lost volume represents roughly 2% of the $171 billion in total holdings it manages.

Investigators and authorities, including the United States Federal Bureau of Investigation, have pinned the breach on the North Korean cyber unit known as TraderTraitor or the Lazarus Group. That same faction was previously blamed for draining $1.5 billion from another trading venue, Bybit, in 2025. Over the weekend, federal investigators published specific digital addresses associated with the perpetrators, calling on market participants to freeze any related movement of capital.

Blockchain tracking specialists working on the recovery effort warned that the stolen capital is already moving through illicit financial networks. Alec Zebrick, a senior manager at Chainalysis, told the BBC that the perpetrators are actively laundering the haul by dispersing transactions through thousands of individual deposits and digital wallets.

Binance has pledged to make all affected users whole. The company stated that it has already restored about 95% of the compromised balances by tapping into corporate reserves, insurance backing, and emergency funds, though recovering the final share may take additional time. Over $6.3 billion has been set aside specifically to absorb the blow.

Preliminary findings by the company suggest the security breach originated when an engineer's laptop was compromised, providing the unauthorized entry point needed to initiate illicit transfers. The breach targeted Binance's primary international exchange, while its American entity remained untouched. Withdrawals for major tokens, including Bitcoin and Ethereum, have been restored, with remaining features scheduled to return gradually following system evaluations.