Binance clients withdrew $3.6 billion after the largest North Korea-linked heist in history

After the partial resumption of withdrawals, Binance clients moved approximately US$ 4.6 billion (equivalent to about R$ 25 billion) in crypto assets on Sunday, the 1st. Of this amount, users withdrew US$ 3.64 billion (R$ 19.8 billion) more than they deposited, totaling a deposit of US$ 1 billion (R$ 5.44 billion).

Binance itself communicated through a post on X/Twitter that the net withdrawn amount corresponded to 2.1% of the assets held on the platform.

The exchange had been the victim of the largest hacker attack recorded in the cryptocurrency sector the previous Thursday, the 29th. In this incident, criminals managed to steal US$ 6.3 billion (R$ 34.2 billion) in cryptocurrencies.

Both the FBI and analysts pointed to North Korean hackers as responsible for the attack. In response to the losses, Binance announced that it mobilized US$ 6 billion (R$ 32.64 billion) to make compensation. This resource was obtained from the exchange's treasury, a specific insurance fund, and a reserve designated to cover security events.

The attack occurred around 5 PM, Brasília time, and lasted about twenty minutes, as evidenced by transaction records analyzed by experts. Initially, Binance suspected that the intruder had accessed one of its engineers' computers. Later, the company confirmed the discovery of security vulnerabilities that were exploited by cybercriminals.

According to TRM Labs, the hackers managed to compromise the system responsible for authorizing cryptocurrency transfers. A portion of the stolen funds was in stablecoins, which are designed to maintain a stable value, functioning as a reflection of global traditional currencies, such as the US dollar.

Founded in 2017 in Shanghai, China, Binance currently has 335 million registered global users, according to its most recent annual report released in 2025. This same report indicates that the company managed approximately US$ 162.8 billion (R$ 879 billion) in digital assets.

Micaella Ribeiro, co-founder of IAM Brasil and an expert in Information Security and Identity and Access Management, commented on the event in an interview with Olhar Digital, stating that the case demonstrates a significant shift in the landscape of digital threats. She emphasized that an attack on a cryptocurrency exchange does not necessarily imply that blockchain technology has been breached.

However, Ribeiro stressed that handling cryptocurrencies carries distinct risks. She pointed out that there is a difference between the security of blockchain technology and the security of the platforms used to trade, store, or buy these assets. For the expert, this attack underscores an alarming trend: criminals are focusing on compromising systems, devices, and identities that already have valid permissions to execute crucial operations.

Binance, the world's largest cryptocurrency exchange, announced that it used its own company funds to purchase replacement tokens, thereby covering $6 billion out of the total $6.3 billion stolen in a hacking attack. According to US officials, this hack was carried out by a state-sponsored North Korean group known as TraderTraitor.

On Saturday, Binance posted a message on X stating: 'We have covered $6 billion of the affected amount,' after previously reporting coverage of 90% of the stolen funds. According to Binance, the remaining amount, which is less than 10%, includes low-liquidity assets that may require more time to locate in the necessary volumes.

The US Federal Bureau of Investigation (FBI) confirmed on Saturday that the North Korean state group TraderTraitor is responsible for the attack. North Korea has long denied using state cyber units to generate income, commit financial theft, and conduct espionage. Representatives of the DPRK in Geneva and its embassy in China did not respond to requests for comment.

The FBI also stated in its announcement that law enforcement observed members of this group converting the stolen assets into Ethereum cryptocurrency and anticipates further laundering of these assets using associated technologies.

Previously, analysts blamed North Korea and suggested that this could be the largest financial robbery in history. Binance is cooperating with industry partners to freeze some of the affected assets, with about $3 billion discovered on Friday.

The company has repeatedly stated its readiness to assume the financial consequences related to the stolen funds. The funds spent on repurchasing tokens were taken from part of its Secure Asset Fund for Users (SAFU) amounting to $1 billion, which is a Bitcoin reserve to protect clients in case of security breaches, as well as from the futures insurance fund and the company's own corporate treasury.

Co-founder Yi He stated on Saturday that 50% of the SAFU funds would be used, while the company committed to replenishing the fund to approximately $1 billion. Following the hack, crypto prices fell on Friday, while Binance tried to reassure customers about the safety of their funds.

Co-founder Richard Teng previously described the hack as a 'sophisticated attack' involving a compromised laptop and malware designed to erase traces of its activity, which complicates the investigation. After the incident, the exchange suspended customer withdrawals, but on Saturday, it announced plans to resume withdrawals on Sunday. As of 02:50 GMT on Sunday, withdrawals had not yet been reopened.

Binance stated that it internally allocated approximately $6.34 billion in corporate funds to cover the losses. Furthermore, the company conducted a new snapshot of assets on its platform as of 00:00 GMT on October 31 as part of the reserve confirmation process. Users holding the 10 listed tokens—BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC—will be able to verify that their assets are backed at least 1:1 once full confirmation is available.

The cryptocurrency exchange Binance has allocated over $6.34 billion from its own funds to fully compensate for possible losses incurred by users following the digital asset transfer incident. According to Podrobno.uz, the exchange's representatives have already begun the process of returning affected assets and are actively cooperating with law enforcement agencies and partners.

According to Binance itself, $5 billion of the total reserved amount is already held in the same tokens that were affected by the incident. The exchange plans to acquire the remaining portion of the assets on the open market and through over-the-counter (OTC) transactions to eliminate any potential deficit for each affected token.

The company warned that due to liquidity constraints of some cryptocurrencies and the timelines for OTC operations, the compensation process may take some time. Binance commits to informing the public about the progress as verified information becomes available.

It is important to note that the $6.34 billion amount does not include assets that were frozen as part of the ongoing investigation. It was previously reported that with the support of crypto industry partners, Binance managed to freeze approximately three billion dollars, and the company continues to interact with regulators and market participants to recover these funds.

Binance emphasized its readiness to cover any confirmed deficits using its own resources. In the future, the safety of client funds will be publicly confirmed through the Proof of Reserves mechanism—the exchange's reserve confirmation.

Prior to the incident, Binance had reported an investigation into a possible hacking attack that followed large transfers of digital assets from wallets associated with the exchange. Preliminary estimates suggested that the total volume of these transactions amounted to $5.8 billion; however, this referred to transferred assets, not a confirmed sum of theft.

The founder of the exchange, Changpeng Zhao, suggested that the situation resembled a hacking attack but assured users of the safety of their funds. He also expressed gratitude to Tether and Circle for their assistance in freezing stablecoins related to the event.