Binance is beginning to see customer withdrawals stabilise following a major security breach that resulted in approximately $6.3 billion worth of cryptocurrency being stolen from the exchange. The world’s largest cryptocurrency trading platform has resumed some services in phases as it attempts to restore normal operations and reassure customers about the safety of their funds.
The exchange reported net customer outflows of $3.64 billion after withdrawal services gradually became available again. This represented around 2.1 per cent of its total assets. Binance said withdrawal activity had slowed following an initial surge, while deposits remained substantial.
The incident has raised fresh concerns about cryptocurrency exchange security, particularly the risks associated with storing large amounts of digital assets on centralised trading platforms.
Binance Reports $3.64 Billion in Net Outflows
The initial withdrawal figures offered an indication of how customers responded when access to their funds began returning.
According to Binance, customers withdrew approximately $4.65 billion, while deposits reached around $1.01 billion during the reported period. This resulted in net outflows of $3.64 billion.
The exchange described the movement as manageable in relation to its overall assets and said withdrawal volumes were moving towards more normal levels.
However, figures from cryptocurrency analytics platform DefiLlama showed higher outflows, highlighting differences in how exchange wallet movements are calculated. Binance disputed the initial estimates, explaining that certain transfers involving its own wallets were not properly reflected in the figures.
Despite the differing assessments, the pace of withdrawals remains an important measure of customer confidence as Binance works to restore its services.
Exchange Replaces Most of the Stolen Assets
Binance has said it has covered approximately 95 per cent of the stolen cryptocurrency, using its own financial resources to purchase replacement tokens.
The exchange reported that around $6 billion had been replaced, while the remaining five per cent involved less liquid digital assets that could take longer to source in the required quantities.
The company has also committed to bearing the financial impact of the breach rather than passing the losses on to customers.
Its recovery efforts include using funds from its corporate treasury, insurance arrangements and the Secure Asset Fund for Users (SAFU), an emergency reserve established to provide additional protection for customers.
Binance’s response is significant for an exchange with hundreds of millions of registered users worldwide. However, replacing stolen assets is only one part of the challenge, with the company also facing questions about how the breach occurred and what measures will prevent similar incidents.
FBI Attributes Attack to North Korean Hacking Group
The Federal Bureau of Investigation (FBI) has attributed the attack to TraderTraitor, a North Korean state sponsored cyber unit.
Investigators said members of the group were observed converting stolen cryptocurrency into Ether, raising concerns about attempts to move and conceal the funds through digital asset networks.
The theft reportedly unfolded within a relatively short period, with investigators examining the methods used to access the exchange’s systems and transfer the cryptocurrency.
Binance co CEO Richard Teng previously described the incident as a complex attack involving a compromised laptop and malicious software designed to remove evidence of its activity.
The FBI’s attribution has added an international dimension to the investigation. North Korea has historically denied accusations of involvement in state-sponsored cybercrime, and the broader circumstances surrounding the incident remain under investigation.
Bitcoin and Ether Recover After Market Pressure
The breach also affected sentiment across the wider cryptocurrency market, with major digital assets experiencing declines as investors assessed the potential consequences.
Bitcoin fell to a six-week low before recovering some ground, while Ether also rebounded after reaching a two month low.
The combined market capitalisation of leading stablecoins, including Tether’s USDT and Circle’s USDC, declined by approximately $1.2 billion, suggesting that some investors were moving funds away from cryptocurrency linked assets.
The market response extended beyond individual tokens. Spot Bitcoin exchange-traded funds recorded significant withdrawals, while leveraged cryptocurrency positions worth more than $1.3 billion were liquidated.
These developments have reinforced concerns that a major security incident involving a leading exchange can influence investor sentiment across the wider digital asset industry.
Customer Confidence Remains a Key Challenge
Binance has approximately 335 million registered users globally and reported $171 billion in total assets under management. Its size makes the incident particularly significant for the cryptocurrency sector.
Although the exchange has taken steps to replace the stolen assets and gradually restore withdrawal services, customers are likely to pay close attention to its security improvements and handling of the investigation.
For individual investors, the incident also highlights the importance of understanding where digital assets are stored and avoiding excessive reliance on a single trading platform.
Some market participants have suggested reviewing exchange exposure and diversifying storage arrangements rather than withdrawing all funds in response to a security incident.
Binance’s latest recovery efforts offer some reassurance, but restoring confidence will require more than financial compensation. Greater transparency, stronger security controls and consistent access to customer funds will remain essential as the exchange works to put the breach behind it.
The incident serves as another reminder that the growth of digital finance brings increasingly complex security challenges, even for the industry’s largest platforms.