Binance users pull $3.6bn as crypto exchange restarts services after heist

Binance users pulled $3.64 billion (€3.21 billion) from the world’s biggest crypto exchange as it resumed services on Sunday after a record $6.3 billion heist.

The company suffered the theft on Thursday night and suspended withdrawals as it raced to fix its platform and investigate how hackers had breached its systems.

Binance said on Sunday that it had begun a slow, phased resumption of its withdrawal services following the hack, which has been blamed on a North Korea-linked group.

Users pulled a net total of $3.64 billion in the hours after withdrawals reopened, equivalent to 2.1 per cent of the value of the assets held on the exchange the day before the hack, according to an update published by the company.

It processed $4.65 billion in withdrawals and $1.01 billion in deposits in the nine-and-a-half hours after withdrawals began, it said.

The company said its phased approach was designed so “each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened”.

Binance started by allowing people who hold the Ethereum, USDT and USDC tokens on the ethereum blockchain to retrieve their funds, as well as some assets held on the BNB Smart Chain blockchain. Later on Sunday it said holders of other tokens, including dogecoin and solana on their respective blockchains, could also withdraw their assets.

Binance said it was prioritising tokens based on user demand in the past week and that users might experience “temporary delays or longer processing times due to traffic volume”.

The company said it would reimburse customers whose assets were stolen in the hack. It has built a pot worth 95 per cent of the stolen funds, paid for from its own revenues and an emergency fund. It was working to buy the remaining 5 per cent worth of tokens in the market, saying these were “less liquid” and taking longer to source at scale.

The FBI on Saturday blamed TraderTraitor, a group of hackers linked to North Korea, for the record theft, saying it expected the funds to be converted and “further laundered”.

North Korea-linked groups have become prolific crypto thieves in recent years. The FBI last year blamed TraderTraitor for a $1.5 billion theft from crypto exchange Bybit.

Binance is working with law enforcement and blockchain analytics companies to investigate how the heist happened and said it would publish a report of its findings.

The company’s initial investigation found that an engineer’s laptop had been compromised, but it later added that further “points of breach” had been discovered.

The scale and speed of the theft have shocked the crypto industry. Richard Teng, co-chief executive of Binance, said after the heist that the company was rebuilding and retesting its “entire infrastructure system” and “conducting a full security review across the entire company”.

“Resuming withdrawals is a major milestone, but our work continues. We will continue strengthening our safeguards [and] completing the recovery process,” Binance said. – Copyright The Financial Times Limited 2026