Binance users pull $3.6bn after $6.3bn hack blamed on North Korea

Binance customers moved roughly $3.6bn out of the exchange on Sunday, the day it reopened for business after a cyberattack in which about $6.3bn worth of digital assets were stolen.

The company said that between 06:00 and 15:30 GMT on November 1 it handled $4.649bn in withdrawals against $1.01bn in deposits, leaving a net outflow of about $3.64bn. It said the rush of withdrawals peaked early and has since eased.

Binance put the figure in context: the money taken out amounts to a little over two per cent of the $171bn in assets it holds for customers. Withdrawals of more than two dozen major coins, including Bitcoin and Ethereum, are running again, while other services will come back in stages as security checks are completed.

What happened, and who is blamed

The breach hit Binance.com, the global exchange, on October 29. Its United States platform said it was not affected. Binance suspended transactions while it dealt with the incident.

The FBI has blamed North Korea's TraderTraitor group, also called the Lazarus Group, which was behind the $1.5bn theft from Bybit in 2025. On Saturday the FBI published wallet addresses linked to the group and asked industry partners to block transactions tied to them. Binance has also asked coin issuers to freeze affected assets.

Binance's early checks suggest the attackers may have got in through a compromised laptop belonging to one of its engineers. The company has not said the matter is closed.

It says it has already replaced about 95 per cent of what was stolen, drawing on its corporate treasury, futures insurance and emergency reserve funds, and that the rest may take longer. Last week it said it had set aside more than $6.3bn to deal with the fallout.

"Binance will fully cover the financial impact of the funds stolen in this incident," the company said.

Recovery is not straightforward. Alec Zebrick of blockchain analysis firm Chainalysis, which is working with Binance and governments, told the BBC's Today Programme that the stolen coins are still moving.

"We continue to see funds being laundered quite actively,"

he said, adding that the attackers are spreading the money across thousands of addresses and deposits.

Why it matters in Nigeria

Binance is one of the crypto platforms many Nigerians use to trade, save and send money, and a scare of this size can push people to move funds quickly. A run on any exchange can slow withdrawals or freeze them, so users should watch official updates before acting on rumours.

Nigeria's regulators have taken a hard line on crypto trading in recent years, and a record heist of this kind is likely to feed that caution. Anyone holding coins on an exchange should treat it as money in someone else's keeping, not in their own pocket.

Binance was founded in China and says it has hundreds of millions of registered users worldwide.

What happens next: Binance says more services will return in phases after security checks, and it is still working to replace the remaining stolen assets. The FBI and Chainalysis are tracking the wallets on its list, but the funds are being moved actively, so recovery could take time.