The world's largest cryptocurrency exchange is facing its sternest test of customer confidence, after resuming withdrawals following the biggest theft in the history of digital assets.
Binance recorded net outflows of about $3.6 billion after it began phasing withdrawals back in around November 1, three days after a hack on October 29 in which roughly $6.3 billion of assets were stolen, according to BigGo Finance, citing Korean media reports. CNBC reported net outflows of $3.64 billion on November 2.
The pace of outflows has slowed sharply, according to the reports. Co-chief executive Richard Teng said some of the transfers were between Binance's own internal wallets, meaning they may have been counted as customer withdrawals when they were not.
The largest crypto hack ever
The theft of about $6.3 billion surpasses all previous crypto hacks, including the $1.5 billion theft from exchange Bybit in February 2025, which had been the largest on record. Initial investigations raised the possibility that an employee's laptop had been compromised, and later probes found additional points of intrusion, according to BigGo Finance.
The FBI, the US Secret Service and blockchain analytics firms have named North Korea as the suspected culprit and are investigating, according to the report. North Korean state-backed hacking groups, often referred to collectively as the Lazarus Group, have been linked to many of the largest crypto thefts in recent years, using stolen funds to finance the country's weapons programmes, according to US and United Nations assessments.
"North Korea-linked crypto hacking continues to grow in scale and has become a major security threat across the industry," said Kwon Joon-hyuk, head of Chainalysis's South Korean branch, according to the report.
Covering the losses
Binance has assembled more than $6.34 billion in company funds to cover the losses, drawing on its own holdings, part of its futures insurance fund and its Secure Asset Fund for Users (SAFU), according to BigGo Finance. The company says it has recovered or covered about 95% of the stolen assets and holds reserves equal to full customer balances for major assets across 10 blockchains, including bitcoin and ether. Less liquid assets are being bought on public markets and through over-the-counter trades.
"Our commitment to bear the financial losses arising from the stolen funds remains unchanged," Binance said.
Binance has pledged not to pass the losses on to users, a commitment designed to prevent a broader loss of confidence that could trigger a run on the exchange.
A test of confidence
For crypto exchanges, customer trust is paramount. Unlike banks, exchanges are not backed by government deposit insurance in most jurisdictions, so customers rely on the exchange's own reserves and commitments. The collapse of FTX in 2022, when customers discovered that their funds had been misused, remains a powerful reminder of the risks.
Binance's ability to resume withdrawals within three days and to demonstrate that it has sufficient reserves is crucial to maintaining confidence. The slowing pace of outflows suggests that many customers are reassured, but the episode will be closely watched by regulators and investors.
Binance's history
Binance, founded by Changpeng Zhao in 2017, grew rapidly to become the world's largest crypto exchange by trading volume. In 2023, the company pleaded guilty to US charges related to anti-money laundering and sanctions violations and agreed to pay more than $4 billion, while Zhao stepped down as chief executive and served a prison sentence. Richard Teng, a former regulator, took over leadership and has sought to strengthen compliance and rebuild relationships with regulators.
Market impact
The hack and subsequent outflows have added to volatility in crypto markets, which have been sensitive to risk sentiment and broader financial conditions. Large hacks can weigh on prices if attackers sell stolen assets or if fear spreads among investors. However, Binance's commitment to cover losses has limited the impact on prices compared with what might have occurred had customers lost their funds.
Regulatory implications
The hack is likely to intensify regulatory scrutiny of crypto exchanges' security practices. Regulators in the United States, Europe and Asia have been developing frameworks for crypto oversight, including requirements for custody, capital and cybersecurity. The scale of the theft may prompt calls for stronger standards, including mandatory security audits and segregation of customer assets.
The Indian angle
India has a large population of crypto investors, despite a heavy tax regime that includes a 30% tax on gains and a 1% tax deducted at source on transactions. Binance registered with India's Financial Intelligence Unit after previously being blocked for non-compliance, allowing it to serve Indian users. Indian investors who use global exchanges will be watching the episode closely.
India has also suffered major crypto hacks, including the 2024 theft of about $230 million from Indian exchange WazirX, which was also linked to North Korea. That incident left many Indian users unable to access their funds for an extended period, highlighting the importance of exchanges' ability to cover losses.
Lessons for the industry
Security experts have long warned that crypto exchanges are prime targets for sophisticated attackers. Common vulnerabilities include compromised employee devices, social engineering, weaknesses in hot wallets and flaws in smart contracts. The Binance hack underscores the need for layered security, strict access controls and continuous monitoring.
How exchanges protect assets
Crypto exchanges typically hold most customer assets in cold wallets, which are kept offline and are harder to hack, while keeping a smaller portion in hot wallets connected to the internet to process withdrawals. Large hacks often target hot wallets or the systems that control transfers between wallets. Attackers may also target employees with access to critical systems through phishing or malware, as investigators believe may have happened in this case.
Binance's SAFU fund was established in 2018 to protect users in extreme situations, funded by a portion of trading fees.
What comes next
Binance will continue to restore services and replenish reserves, while investigators trace the stolen funds. Blockchain analysis firms often track stolen crypto as attackers attempt to launder it through mixers, cross-chain bridges and over-the-counter brokers, and some funds may be frozen or recovered. The episode will shape the debate over crypto regulation and security for months to come.
For the wider crypto industry, the response to the hack will be a defining test of whether the sector has matured enough to withstand major shocks without the kind of collapse seen in 2022.
