Binance reopens withdrawals as $3.6 billion leaves after record hack

Customers pulled a net $3.64 billion from Binance after it reopened withdrawals following a breach of about $6.3 billion. North Korea denies the FBI's attribution of the hack, and tracing of the stolen funds continues.

What happened

Binance customers withdrew $3.6bn after the exchange reopened on Sunday, November 1. Transactions had been suspended after a breach affecting $6.3bn in digital assets, which has been described as the largest hack in history [1]. Another account puts the net outflow at $3.64 billion in one trading window. That is 2.1% of the platform's $171 billion in assets [2]. A third account puts the November 1 net outflow at roughly 2% of $171bn in assets under management [1].

Binance says withdrawal volumes are stabilising [1][2]. It says it has covered about 95% of the affected amounts and will fully cover losses [1]. It is reopening withdrawals progressively [3].

On November 3, North Korea denied responsibility. Kim Yo Jong rejected the FBI's attribution of the hack to the DPRK-linked TraderTraitor group and called it a political provocation [3]. The FBI had linked the breach to North Korean hackers operating under the TraderTraitor name [2]. Press accounts also name the Lazarus Group as accused [1].

Elliptic and Chainalysis report complex laundering across roughly 12,000 wallets and 11 blockchains [3]. They put the amount stolen at $6.43 billion. About $2.85 billion of that has been frozen or seized, and $3.24 billion remains in theft-linked addresses [3]. Chainalysis says the stolen funds are still being actively laundered [1]. The sources give slightly different totals for the theft ($6.3bn and $6.43 billion), so the exact figure is not settled in the reporting [3][1].

How we got here

FinUties' news monitor has logged 3 reports on this story from 2 outlets in recent days, and 102 earlier related reports going back to 2025-12-04. The attribution to North Korea arrives against a backdrop of tense and shifting relations on the peninsula in recent months.

In late August, the US and South Korea ended the joint staff exercise Ulchi Freedom Shield six days early. President Donald Trump had ordered it scaled back shortly before it began and called it an inappropriate and hostile signal. North Korea still treated the early end as provocative and fired about ten ballistic missiles toward the sea the next day [4]. Trump also said he would meet Kim Jong Un later this year [4].

On September 19, North Korea's Foreign Ministry and Kim Yo Jong rejected an IAEA resolution criticising its nuclear weapons programme. They called its nuclear-weapons-state status irreversible [5]. On September 23, South Korean President Lee Jae Myung told the UN General Assembly that a Trump–Kim meeting could restart long-suspended dialogue and move toward a peace regime. Kim Yo Jong, meanwhile, called Pyongyang's nuclear status absolute [6].

On October 1, Lee urged the North to resume dialogue. This came a day after the two Koreas traded accusations over a landmine incident at the DMZ that wounded three South Korean soldiers. Seoul's military and the UN Command called the incident an armistice violation. Kim Yo Jong rejected those findings as fabricated and warned of retaliation [7]. On October 23, Seoul proposed military talks to ease border tensions. It cited North Korea's announcement that new military units had moved into firing positions, and an incident on October 19 in which three South Korean soldiers were injured near the DMZ. Seoul acknowledged skepticism about the North's willingness, given its past rejections of dialogue offers [8]. The sources date the injuries differently, so it is not clear whether they describe one incident or two.

What changed is that Pyongyang's pattern of denying and rejecting accusations now extends to a financial-crime allegation. Kim Yo Jong's denial follows her earlier rejections of the UN nuclear watchdog's resolution and of the DMZ findings [3][5][7].

Why it matters for markets

The clearest channel is exchange liquidity and confidence. A net outflow of about 2% of assets after a reopening could indicate how willing customers are to keep funds on the platform after a breach. Binance's statement that volumes are stabilising would, if sustained, point to the outflow easing [1][2]. Its coverage of about 95% of affected amounts and its pledge to absorb the losses would limit direct losses for customers [1][2].

The laundering across many wallets and chains could mean further freezes or seizures. The $3.24 billion still in theft-linked addresses is the pool that tracing efforts are focused on [3]. Beyond these exchange and asset-tracing effects, the reporting shows no direct link to rates, currencies or broader asset prices.

What to watch

• Whether Binance's outflows keep easing and whether it finishes reopening withdrawals [3][2].
• Whether the amount frozen or seized, now about $2.85 billion, rises as Elliptic and Chainalysis keep tracing funds [3].
• Whether the FBI or other agencies add detail to the TraderTraitor attribution, and how Pyongyang responds after its denial [3][2].
• Whether the Trump–Kim meeting that Trump has said he plans for later this year goes ahead, and how Seoul's offer of military talks fares [5][6][8].
• The settled size of the theft, since reported totals currently differ [3][1].

Sources

1. BBC News: Binance users withdraw $3.6bn after largest-ever crypto hack, 02 Nov 2026
2. US Top News and Analysis: Binance sees $3.64 billion in net outflows as withdrawals resume after massive hack, 02 Nov 2026
3. US Top News and Analysis: North Korea denies links to Binance hack as researchers trace stolen billions, 03 Nov 2026
4. tagesschau.de: Südkorea und USA beenden Militärübung vorzeitig, 21 Aug 2026
5. Al Jazeera: North Korea dismisses UN nuclear watchdog resolution, 19 Sep 2026
6. US Top News and Analysis: South Korea pushes for Trump summit with renegade North Korea, seeing opportunity for peace, 23 Sep 2026
7. World News Today: International News Headlines: South Korea's Lee urges North Korea to restore dialogue, pledges military buildup, 01 Oct 2026
8. Al Jazeera: South Korea invites North for military talks over border, 23 Oct 2026

---

FinUties generates this briefing for transparency. Published after editorial review. It may summarize source data and does not provide investment recommendations. Data availability at one timestamp does not guarantee future continuity.

Provenance

• Study: event-desk-20261103-binance-reopens-withdrawals-as-3-6-billion-leaves-after-reco (11d10545-d0d6-468a-ac7e-0ad864ee640d)
• Author: FinUties Research
• Approved by: FinUties Research at 2026-11-03T22:44:00.587016Z
• Kind: event brief (news sources, not a FinUties dataset study)
• Cited sources: 8 from 5 outlets, all licensed for public use

• Earlier related events cited from 2026-08-21

• Manifest: /api/v1/research/studies/event-desk-20261103-binance-reopens-withdrawals-as-3-6-billion-leaves-after-reco/manifest

• Replay tolerance: append_only_sources