Binance reopened trading on Sunday after suspending all operations following a cyberattack that compromised more than $6 billion in digital assets, according to France 24. The exchange has also reported that customers withdrew heavily on the day it reopened, while the US Federal Bureau of Investigation (FBI) has linked the theft to North Korea. The Binance hack North Korea link is disputed, and the attribution has been made by the FBI rather than confirmed by Binance.
Binance said net withdrawals between 06:00 and 15:30 GMT on November 1 were about $3.64 billion, roughly 2.1% of the assets it manages, according to Euronews. Other outlets gave different figures for the same day. France 24 reported that customers withdrew some $3.4 billion, while BBC World reported $3.6 billion withdrawn. The France 24 item is a short excerpt, so its figures could not be checked against a full article.
The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance and attributed it to actors it calls TraderTraitor, according to Euronews. US President Donald Trump cast doubt on the attribution, saying, "We don’t know if it’s North Korea," according to Euronews. North Korea has not responded to the claims in the sources reviewed.
TraderTraitor, also known as the Lazarus Group, was blamed for a $1.5 billion theft from Bybit in February 2025, according to Euronews. The Lazarus Group gained notoriety in 2014 when it was accused of hacking Sony Pictures over the film The Interview, according to Euronews.
Binance said it had set aside more than $6.34 billion in company funds to cover losses from the hack. It said withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, according to Euronews. Binance said early checks suggest the incident may have started with a compromised laptop belonging to an engineer, according to BBC World. That explanation has not been independently confirmed.
The figures on how much of the stolen money has been replaced also differ. BBC World reported that Binance said it has covered around 95% of the stolen assets. Euronews reported that Binance said it used company funds to replenish 90% of what was stolen, with the remaining 10% less liquid. Binance said the remaining amount may take longer to source.
Market prices fell after the news of the hack. Bitcoin dropped nearly 5%, Ethereum nearly 6% and BNB nearly 10%, according to Euronews.
Binance says its remaining services will resume in phases after security checks, though the sources give no detail on which services or when. Chainalysis says laundering of the stolen funds continues, according to BBC World, a view from a single analyst with no figure given. The FBI has asked industry partners to block transactions linked to the wallets it listed.
Sources
This article was written with AI assistance from the published reporting listed above. It is part of the World Brief daily news podcast.