Binance’s customers have withdrawn a net $4.72 billion from the world’s biggest cryptocurrency exchange since it reopened, after hackers stole around US$6.3 billion of crypto from the platform in what could be the largest financial heist in history.
The exchange froze withdrawals for about 48 hours after the hack, which which the FBI said was carried out by North Korea, then started allowing customers to withdraw again on Sunday morning.
The theft has underlined the vulnerability of digital assets to attacks and raised questions about the impact on Binance, which has vowed to repay customers in full, and on the wider market.
Binance said the net outflows amounted to around 3% of assets on the platform, a relatively modest figure that analysts said suggested customer confidence had largely held up.
“The majority of the withdrawals from the platform were in the form of Tether’s USDT stablecoin,” Binance added.
The outflow compares with about US$7 billion withdrawn from Circle’s USDC stablecoin over a week after the collapse of Silicon Valley Bank in 2023.
Binance itself processed net outflows of about US$6 billion over 72 hours in 2022 after the collapse of FTX.
The attack marks a step-up in North Korea’s crypto thefts. Blockchain analytics firm TRM Labs said North Korea-linked hackers have stolen US$7.4 billion so far in 2026.
Analysts and crypto experts said the fallout appeared limited so far, and there was little sign of an impact on broader financial markets despite a deepening of ties between crypto and mainstream finance in recent years.
“Binance will absorb the financial impact of the stolen funds, not our users,” the company said in a statement on X.
Binance said it was covering the losses with company funds and had already raised US$6 billion from its corporate treasury, an insurance fund and reserves set aside for security breaches.
“It has not yet triggered widespread panic or a massive, concentrated withdrawal,” said Tim Sun, a senior researcher at HashKey Group, a digital asset financial service company in Hong Kong.
Binance, which says it has more than 335 million users worldwide and average daily trading volumes of US$95 billion across digital assets and derivatives, said it had also seen US$2.7 billion in customer inflows since Sunday and that withdrawal volumes were stabilising after an “initial spike”.
No rush to withdraw
Some traders told Reuters they were keeping their accounts.
Ryan Tan, a Binance user, said he was in no hurry to withdraw his funds from the platform, as he had already kept his account fairly light since the collapse of FTX four years ago.
“After the FTX collapse, I decided to hold everything on my wallet instead of leaving them on exchanges,” said the 39-year-old.
After hitting a six-week low on Friday, Bitcoin prices recovered through the weekend to trade near $78,000 on Monday, while Ether (ETH) also rebounded from a two-month low.
Stablecoin market capitalisations, often viewed as a gauge of money moving into and out of crypto markets, have fallen since Friday, suggesting some investors have shifted funds into cash or traditional assets.
Binance started allowing US dollar cash withdrawals again on Monday.
“Highly complex” money laundering
The FBI said on Saturday that the North Korean state-sponsored group TraderTraitor was responsible for the attack.
Researchers describe the group as highly sophisticated and say its activities help fund the country’s weapons programmes.
Analysts said the attack’s scale could curb institutional appetite for cryptocurrencies.
Spot bitcoin ETFs recorded outflows of US$643 million on Friday, the largest daily withdrawal in October, while more than US$1.3 billion in leveraged positions were liquidated, according to Ari Redbord, global head of policy at TRM Labs.
“A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people’s capital,” he said.
About half of the stolen funds were held in stablecoins and have been frozen by issuers including Circle, which said on Monday it had frozen more than US$1.1 billion in USDC.
Blockchain research firm Elliptic said around US$3.24 billion of stolen crypto is being held by wallet addresses linked to the theft, describing the laundering process as “highly complex and clearly automated”.
Jonathan Benton, founder and chief executive at crypto asset recovery firm iSanctuary, said the technology exists to trace stolen funds, but the challenge is turning that intelligence into rapid, coordinated action before those assets disappear.
“The future of crypto won’t be decided by how much money enters the market, but by how safe that money is once it’s there,” said Benton, former head of the international corruption unit of the UK’s National Crime Agency.
