Binance, the world’s largest cryptocurrency exchange, reopened on Sunday after a breach that analysts say is the biggest ever in the sector. In the hours following the incident, users moved a net $3.64 billion out of the platform, a figure that represents just over 2 % of the $171 billion the firm manages.
What happened?
According to Binance, the attack began when a compromised laptop belonging to an engineer allowed hackers to execute unauthorised transactions on its global centralised exchange, Binance.com. The US‑facing platform was reportedly untouched. The breach impacted $6.3 billion worth of digital assets, prompting the firm to suspend all transactions while it assessed the damage.
Scale of the hack
Authorities, including the FBI, have linked the intrusion to the North Korean cyber‑crime group known as TraderTraitor or the Lazarus Group. The group previously stole a record $1.5 billion from the crypto exchange Bybit in 2025. The FBI has published a list of wallet addresses associated with the group and urged industry partners to block transactions involving them.
Mass withdrawals
Between 06:00 and 15:30 GMT on 1 November, Binance processed:
- $4.649 billion in withdrawals
- $1.01 billion in deposits
Resulting in a net outflow of approximately $3.64 billion. The initial surge in withdrawals later tapered off, and Binance said the flow was "stabilising as expected".
Binance’s response
The exchange has taken several steps to mitigate the fallout:
- It reserved more than $6.3 billion in funds to address the incident.
- It has covered around 95 % of the stolen assets using its corporate treasury, futures insurance, and emergency reserve funds.
- It resumed withdrawals of over two dozen major cryptocurrencies, including Bitcoin and Ethereum, and plans to restore other services in phases after security checks.
Binance reiterated its commitment to fully compensate users for the financial impact of the hack.
Ongoing investigation and money tracing
Chainalysis senior manager Alec Zebrick told the BBC’s Today Programme that the stolen funds are still being laundered. He described a pattern of "layering" the money across thousands of addresses and deposits, indicating a sophisticated effort to obscure the trail.
Law enforcement agencies, together with blockchain analytics firms, continue to track these movements in hopes of recovering the remaining assets.
Implications for the crypto market
The incident underscores the vulnerabilities inherent in centralized crypto platforms. While Binance’s rapid reimbursement of most losses may reassure users, the breach highlights the need for stronger security protocols and clearer industry standards. The involvement of a state‑linked group also raises geopolitical concerns, as nations grapple with the challenge of policing cross‑border cyber‑crime in the rapidly evolving digital‑asset space.
What users should do
For those holding assets on Binance or similar exchanges, experts advise:
- Enable multi‑factor authentication on all accounts.
- Regularly review device security, especially laptops and mobile devices used for trading.
- Consider diversifying holdings across multiple platforms or using hardware wallets for long‑term storage.
Staying vigilant and adopting best‑practice security measures can help mitigate the risk of future breaches.
Uncertainty
While Binance reports that 95 % of the stolen funds have been replaced, the exact timeline for recovering the remaining portion remains unclear. Ongoing investigations by the FBI and international partners may reveal further details about the perpetrators and the full extent of the laundering activities.