The world’s largest cryptocurrency exchange is working to restore confidence after a $6.3 billion cyberattack, with billions withdrawn even as the company promises to replace affected assets.
For millions of cryptocurrency investors, the ability to access their money whenever they need it is one of the biggest attractions of digital finance. But when Binance temporarily suspended withdrawals following a record-breaking cyberattack, that convenience suddenly became a major concern.
The world’s largest cryptocurrency exchange is now dealing with the financial and reputational consequences. Customers have withdrawn a net $4.72 billion (Dh17.3 billion) since withdrawal services resumed, highlighting how quickly a security incident can influence decisions across the digital asset market.
The withdrawals followed an attack in which approximately $6.3 billion in cryptocurrency was stolen from the platform. Binance suspended withdrawals for more than two days before gradually restoring services on Sunday, November 1.
Although the exchange says customer activity is returning to normal, the scale of the money movement has placed its security arrangements and customer confidence under fresh scrutiny.
Customers move billions, but deposits continue
The $4.72 billion in net withdrawals represents approximately 3 per cent of the assets held on Binance, according to the company. Most of the money leaving the platform was held in Tether’s USDT stablecoin, which is designed to maintain a value linked to the US dollar.
The choice of stablecoins is significant. Rather than necessarily abandoning cryptocurrency altogether, some customers may be seeking to reduce exposure to market fluctuations while reassessing where they keep their digital holdings.
However, the movement has not been entirely in one direction. Binance reported $2.7 billion in customer inflows after reopening withdrawals, indicating that deposits continued despite concerns surrounding the breach.
The company said withdrawal volumes initially increased sharply before declining and stabilising. Analysts have also said the outflows have not amounted to a widespread panic, although the incident could influence how investors assess the risks of keeping funds on centralised exchanges.
Binance promises to cover the stolen assets
For customers concerned about whether their balances are protected, Binance has sought to make its financial position clear.
Co-CEO Richard Teng said at Hong Kong Fintech Week on Tuesday that the exchange remained in a strong financial position and had sufficient resources to absorb the losses.
Binance has replenished 95 per cent of the affected cryptocurrency through its Secure Asset Fund for Users (SAFU) and other company reserves. The remaining 5 per cent consists of less liquid tokens, which the company is working to source through over the counter providers.
Teng also said Binance would publish a detailed report explaining the incident.
The commitment to replace affected assets is an important part of the company’s response. However, replenishing customer holdings and recovering the cryptocurrency stolen by hackers are two separate challenges. Replacing assets does not automatically mean that the original stolen funds have been retrieved.
Investigation points to North Korean linked hackers
The Federal Bureau of Investigation (FBI) has attributed the attack to TraderTraitor, a hacking group linked to North Korea. Pyongyang has rejected the allegation.
Blockchain analytics firm Elliptic estimated that hackers still controlled approximately $3.28 billion in stolen cryptocurrency, primarily Bitcoin and Ether.
Efforts to restrict the movement of the stolen funds have involved other companies in the cryptocurrency industry. Stablecoin issuer Circle has frozen more than $1.1 billion in USDC connected to the incident.
Such interventions demonstrate how blockchain transactions can be traced and, in certain circumstances, digital assets can be frozen by their issuers. However, identifying stolen funds does not guarantee their recovery, particularly when attackers attempt to move assets across different networks and services.
The scale of the theft has also raised questions about the security systems used by major cryptocurrency platforms and the safeguards required to protect customer assets.
Why the incident matters beyond Binance
Binance says it serves more than 335 million users worldwide and handles average daily trading volumes of approximately $95 billion across digital assets and derivatives. Its size means that a major security incident can attract attention well beyond its own customer base.
For someone holding cryptocurrency on an exchange, the distinction between owning a digital asset and having immediate access to it is particularly important. Customers rely on platforms to maintain secure infrastructure, process withdrawals and protect their accounts against unauthorised activity.
The Binance incident has brought those expectations into focus. Even when an exchange promises to cover losses, customers may reconsider how much cryptocurrency they want to leave on a single platform.
The wider market has so far avoided a major disruption, with Bitcoin and Ether recovering from recent lows over the weekend. Nevertheless, analysts have warned that institutional investors could become more cautious when evaluating the security risks associated with digital assets.
For Binance, the next challenge goes beyond replacing the affected cryptocurrency or reopening withdrawal services. It must show customers that the systems protecting their money are capable of withstanding increasingly sophisticated cyberattacks.
The $4.72 billion withdrawal figure may eventually fade from the headlines, but the questions it has raised about digital asset security are unlikely to disappear so quickly.