Investors have withdrawn a net $3.6 billion from Binance after the cryptocurrency exchange reopened withdrawals on Sunday, three days after North Korea-linked hackers stole $6.3 billion from its digital wallets in a 20-minute attack.
Binance resumed customer withdrawals at around 6am on Sunday after suspending the service following Thursday’s cyberattack. Chief Executive Richard Teng said that the exchange had started a “phased resumption of withdrawals” as it worked to restore access to customer funds.
The exchange said that customers withdrew $4.6 billion while depositing $1 billion, resulting in net outflows of $3.6 billion. However, the withdrawals did not pose an immediate threat to the company’s financial position, as Binance held assets worth more than $150 billion, according to CoinMarketCap data.
Binance founder Changpeng Zhao stated that the decline in Bitcoin’s price could have been greater without intervention from US law enforcement agencies. Bitcoin had fallen nearly four percent since the attack on Thursday.
“Many crypto bros may not realise, a lot of the ‘why Bitcoin didn’t drop more?’ credit goes to them,” Zhao wrote on X.
The Federal Bureau of Investigation (FBI) formally attributed the attack to North Korea on Saturday, identifying a hacking group known as TraderTraitor as responsible.
The attackers stole $6.3 billion from Binance’s digital wallets in 20 minutes before moving the funds through a series of transactions to launder the money. Hackers reportedly gained access to the exchange’s systems after infiltrating a Binance engineer’s laptop.
They then transferred billions of dollars between different cryptocurrencies and lending services in an attempt to make the funds difficult to recover. Cryptocurrency firms Tether and Circle froze around $3 billion of the stolen funds, while hackers rendered billions more effectively inaccessible.
Binance said it had covered around 95 percent of the stolen funds through its reserves and an insurance fund. Teng said the exchange, rather than its customers, will bear the financial loss.
“Binance will absorb the stolen funds, not our users,” he stated.
The attack has also drawn attention to North Korea’s cyber operations. Despite limited internet access for most of its population, the country operates a state hacking programme that recruits students with strong mathematics skills.
Analysts at TRM Labs estimated that North Korean hackers had stolen $12.8 billion in cryptocurrency over the past decade, including $7.4 billion in 2026 alone.
TraderTraitor operates as part of the wider Lazarus Group, which hacked Sony Pictures in 2014 over a film that mocked North Korean leader Kim Jong-un. The country’s cyber operations involve an estimated 7,000 hackers and other officials.
Kim has described the hackers as “warriors” serving a “strong and prosperous nation”.
President Donald of United States (US) Trump said on Saturday, before the FBI issued its statement, that he will speak to North Korea if investigators establish its involvement in the attack.
“We’re learning about it. We don’t know if it’s North Korea,” Trump said. “But if it is, we’ll talk to North Korea about it.”
Binance said restoring customer access remained its priority and that it will continue bringing services back in phases. The exchange also said deposits remained open and were unaffected by the incident.
