Binance Reports $4.7 Billion in Net Withdrawals After Reopening Following $6.3 Billion Hack the FBI Attributes to North Korea
Binance says it covered most of the stolen crypto with its own money. Reports differ on whether that share is 90% or 95%, and its proof-of-reserves report is due Tuesday, Nov. 3 (UTC), after a delay.
$4.7 billion out, $6.3 billion gone
By Monday morning in London, net withdrawals from Binance had reached $4.7 billion, a company spokesperson said[1]. "Net" means money taken out minus money put in. That outflow came days after attackers drained about $6.3 billion from the same exchange.
The two numbers sit side by side. A record theft and a rush of customers leaving would normally spell disaster. Yet Binance says no customer balance was cut. So the question is how much strain this really is.
Binance is the world's largest crypto exchange. On or about October 29, 2026, attackers moved about $6.36 billion out of its "hot wallets" on about 10 blockchains[6][8]. A hot wallet is an account kept online so withdrawals can be paid out fast. Most of the money left in about 20 minutes[7][8].
On October 31, the FBI said North Korea was responsible. It named a state-backed hacking unit it calls TraderTraitor[2]. Binance paused withdrawals, then began reopening them in phases on Sunday, November 1, starting with bitcoin[12].
What nobody is arguing about
The major outlets we reviewed accept the FBI's attribution. We found no public response from North Korea. In past cases, Pyongyang has denied running crypto theft and called U.S. accusations hostile propaganda[20].
TRM Labs, a blockchain-tracing firm, attributes the theft with "high confidence." It calls it the largest crypto hack on record[6]. TraderTraitor is the same group the FBI blamed for the $1.5 billion theft from the exchange Bybit in February 2025[11][22].
Binance has linked the breach to a compromised laptop belonging to a DevOps engineer, who manages the company's technical systems. CEO Richard Teng later said the attack "did not simply use one engineer's permissions"[7][8].
Some of the money is already out of the thieves' reach. Tether froze more than $1.5 billion of the stolen assets. In total, about $3 billion has been frozen or located[8].
Why the thieves got in, and why the money is hard to catch
Exchanges keep part of their funds online so withdrawals go out quickly. They keep the rest offline in "cold storage," which is safer but slower. Critics see the hot wallet as a security failure. The industry sees it as the cost of offering instant withdrawals.
In this attack, the thieves used a 2025 Ethereum feature called EIP-7702, along with 50 pre-signed authorizations. That let them turn a hot wallet into an automatic "sweeper" that drained it[8].
Freezing the loot depends on who issues the coin. Tether could freeze more than $1.5 billion because it controls its own token[8]. Ethereum has no central issuer, so it can't be frozen that way. That's why the FBI says it has watched TraderTraitor convert the funds into Ethereum[2].
The FBI expects the funds to be laundered through decentralized finance (DeFi) platforms and instant swap services. It urged firms to block the linked wallet addresses[2][24]. Recovery is hard. Much of the Bybit money was laundered[22].
A bank that survived a robbery, or one under strain?
Binance's case is simple. An exchange is judged by whether customers get their money back, not by whether it's ever attacked. It says it covered the losses with its own funds, so customer balances were not cut[4][12]. It set aside about $6.34 billion from its Secure Asset Fund for Users (SAFU), its corporate treasury and its futures insurance fund[3][4].
Founder Changpeng Zhao says 98% of users "chose to stay" and calls that a sign of trust[14]. He also credits the FBI's fast attribution with keeping bitcoin from a deeper crash[15]. Binance has its own reasons to stress this. It wants to stop withdrawals from becoming a run, and it wants to keep its market share.
The numbers are less tidy than that. Reports disagree on how much was replaced. The Associated Press reported 90%. Binance said the rest was "less liquid" and would take longer to buy[26]. Other outlets reported about 95%[4].
Binance's reported assets fell from $144.90 billion before the hack to $128.87 billion after, by one data site's count[5]. Reuters described the $4.7 billion outflow as under 4% of the roughly $128 billion still on the exchange. That's a strain, not a collapse.
But Binance's figure may be the low one. Third-party tracking cited by the same data site shows about $5.95 billion out in the first 24 hours. The Financial Times reported about $5 billion[5]. One crypto site says Binance has "shed" about $16 billion since the hack. That figure appears to blend the theft, withdrawals and price moves[5].
On Sunday alone, Binance said it processed $4.65 billion in withdrawals and $1.01 billion in deposits between 0600 and 1530 GMT[3][13]. Most of these numbers come from Binance itself. None has been independently audited.
The test arriving Tuesday
An exchange holds customers' coins much as a bank holds deposits. If enough customers ask at once, it must have every coin on hand. That's why confidence matters so much here[4][5].
Binance says it will publish a zero-knowledge proof-of-reserves report on Tuesday, November 3 (UTC). The report matches the exchange's wallets against customer balances. It was delayed from Monday because generating it takes roughly 40 to 50 hours[5].
Markets have so far held. Bitcoin briefly slipped toward $76,700, stayed above the closely watched $75,000 level, and traded near $78,000 on Monday[4]. Some analysts see bitcoin stabilizing if withdrawals keep going smoothly. Others are watching whether outflows speed up[4][23]. Trade press frames the week around the Binance fallout, the U.S. midterms and the jobs report[23].
For North Korea, the stakes run the other way. Analysts say crypto theft gives the heavily sanctioned state hard currency for its economy and its nuclear program[9][21]. If about $3 billion stays frozen, its net take shrinks sharply. U.S. sanctions pressure may also increase[8][2].
Who tells it which way
The coverage differed less on facts than on emphasis. The Associated Press ran it mostly straight, and it was the outlet that used the 90% figure[11]. Bloomberg led with outflows, the number markets watch. That figure came from a Binance spokesperson, so it's the company's own[1].
Fox Business and The Epoch Times framed it as a national-security story about "the regime in Pyongyang"[10][25]. Al Jazeera stressed the record scale and the weapons-funding context[9]. The South China Morning Post chose the word "spike" for the withdrawals, without giving them as a share of total assets[19].
Crypto trade sites split. Benzinga put Zhao's "98% chose to stay" in its headline, though "touts" adds some distance[14]. Bitcoin.com led with the larger "$16B" figure[5].
One thread is nearly missing. Zhao pleaded guilty to a money-laundering-related charge and was pardoned by President Trump in October 2025[16][17]. Before the pardon, an Emirati state-backed fund used the Trump family's World Liberty stablecoin to complete a $2 billion investment in Binance[16][17]. Critics, including Sens. Elizabeth Warren and Jack Reed, have pressed on North Korean crypto theft before and want conflict-of-interest safeguards in any crypto bill[17][18]. In our searches, right-leaning outlets didn't mention the ties. We also found no left-leaning outlet linking them to this hack, and no Warren statement on it.
What's left is a short list. Will Tuesday's report confirm the backing? How much of the remaining roughly $3 billion can still be frozen? And will the outflows slow, or speed up?
Summary
Binance is the world's largest cryptocurrency exchange. On October 29, 2026, attackers drained about $6.3 billion in crypto from it, mostly within about 20 minutes[7][8]. TRM Labs calls it the largest crypto theft on record[6]. On October 31, the FBI said North Korea did it. The FBI named a state-backed hacking unit it calls TraderTraitor[2]. Binance paused withdrawals, then began reopening them in phases on Sunday, November 1, starting with bitcoin[12].
Customers then pulled money out. A Binance spokesperson said net withdrawals reached $4.7 billion by Monday morning in London[1]. 'Net' means money taken out minus money put in. One data site puts Binance's total holdings at about $128–129 billion after the hack[5]. Reuters describes the outflow as less than 4% of the roughly $128 billion still on the exchange. Third-party tracking cited by the same data site shows larger outflows than Binance's own figure, about $5.95 billion in the first 24 hours, and the Financial Times reported about $5 billion. Binance says it covered most of the stolen amount from its own reserves, so customer balances were not cut[4][12]. Reports disagree on how much it replaced. The Associated Press reported 90%, and Binance said the rest was 'less liquid' and would take longer to buy[26]. Other outlets reported about 95%[4].
The main question in dispute is not who did it. The major outlets we reviewed accept the FBI's attribution, and we found no public response from North Korea. The dispute is about what the outflows mean. Binance and its founder Changpeng Zhao point to customers who stayed. Zhao says 98% did[14]. They say the episode shows Binance can absorb a record loss[14]. Skeptics point to the drop in assets and the open questions about security. One crypto news site says Binance has 'shed' about $16 billion since the hack. That figure appears to include the stolen funds and price moves, not just withdrawals[5]. Binance says it will publish a zero-knowledge proof-of-reserves report on Tuesday, November 3 (UTC). It was delayed from Monday because generating it takes roughly 40 to 50 hours[5]. That report is the next checkable data point.
The Event
On or about October 29, 2026, attackers moved about $6.36 billion out of Binance's 'hot wallets' on about 10 blockchains[6][8]. A hot wallet is an exchange account kept online so withdrawals can be paid out quickly. On October 31, the FBI said North Korea's TraderTraitor unit was responsible[2]. Binance reopened withdrawals for bitcoin and assets on 15 networks on November 1[12][13]. A company spokesperson said net outflows reached $4.7 billion by Monday morning, November 2[1].
Undisputed Facts
- The FBI said North Korea stole more than $6 billion in virtual assets from Binance on or about October 29, 2026. It attributed the theft to the unit it calls TraderTraitor[2].
- Blockchain analysis firm TRM Labs put the theft at $6.36 billion across 10 blockchains. It called it the largest crypto hack on record[6].
- Binance has linked the breach to a compromised laptop belonging to a DevOps engineer, an employee who manages the company's technical systems. CEO Richard Teng later said the attack 'did not simply use one engineer's permissions'[7][8].
- Tether froze more than $1.5 billion of the stolen assets. In total, about $3 billion has been frozen or located[8].
- Between 0600 and 1530 GMT on Sunday, November 1, Binance said it processed $4.65 billion in withdrawals and $1.01 billion in deposits[3][13].
- A Binance spokesperson said net withdrawals reached $4.7 billion by Monday morning in London[1].
- Binance said it set aside about $6.34 billion of company funds to cover the losses. The money came from its Secure Asset Fund for Users (SAFU), its corporate treasury and its futures insurance fund[3][4].
- TraderTraitor is the same group the FBI blamed for the $1.5 billion theft from the exchange Bybit in February 2025[11][22].
The Pressure
Strip away the moralizing and blame. What structural realities persist regardless of which narrative wins?
- Exchange solvency depends on confidence
- An exchange holds customers' coins much as a bank holds deposits. If enough customers ask for their coins at once, the exchange must have every coin on hand. That is why Binance stresses 1:1 backing and why it will publish proof of reserves on Tuesday[4][5]. A proof-of-reserves report is a snapshot that matches the exchange's wallets against customer balances.
- Hot wallets trade safety for speed
- Exchanges keep part of their funds online in 'hot wallets' so withdrawals go out quickly. They keep the rest offline in 'cold storage,' which is safer but slower. In this attack, the thieves used a 2025 Ethereum feature, EIP-7702, along with 50 pre-signed authorizations. That let them turn a hot wallet into an automatic 'sweeper' that drained it[8]. Critics see a security failure. The industry sees the cost of offering instant withdrawals.
- Sanctioned state revenue
- North Korea is cut off from most global finance. Analysts say crypto theft is one of its main sources of hard currency[9][21].
- Freezes need centralized issuers
- Tether could freeze more than $1.5 billion because it controls its own token[8]. Assets with no central issuer, such as Ethereum, cannot be frozen that way. That is why the FBI expects the thieves to keep converting into Ethereum[2].
Material realityAbout $6.3 billion left Binance in minutes. About $3 billion of it has been frozen or located[8]. Binance says it covered most of the loss with its own funds, either 90% or 95% depending on the report[26][4]. So customers' balances are intact on paper, and the company's reserves took the hit. Net outflows of $4.7 billion are about 3.6% of the $128.87 billion one data site counts as still on the exchange[1][5]. That is a strain, not a collapse. Bitcoin held above $75,000 through the reopening[4]. The main open questions are three. Will the Tuesday reserve report confirm the backing? How much of the remaining roughly $3 billion can still be frozen? Will the outflows slow or speed up?
Narrative as a weaponThree parties shape most of the coverage. Binance and Zhao want readers to focus on users who stayed and on losses covered[14][15]. The FBI wants the industry to see a state-run laundering operation that must be blocked now[2]. Crypto trade sites set the market mood. Some lead with Binance's reassuring numbers, and others with large combined figures such as the '$16B shed'[5][14]. The political story, Binance's ties to the Trump family business and Zhao's pardon, is mostly absent from this week's hack coverage on both sides. Right-leaning outlets in our search did not mention it[10][25]. Democratic critics have not yet been quoted linking it to the hack[16][17]. Note that most of the hard numbers, including outflows, deposits and the share replaced, come from Binance itself and have not yet been independently audited.
How Each Side Sees It
Each major actor’s view — how it frames things, its underlying incentive, and how it’s materially affected. Tap a side to read it.
Frames it asBinance argues that the test of an exchange is not whether it is ever attacked. The test is whether customers get their money back. It says it covered the losses with its own funds, so customer balances were not cut[4][12]. Zhao says 98% of users 'chose to stay' and calls that a sign of trust[14]. He also credits the FBI's fast attribution with keeping bitcoin from a deeper crash[15]. Binance compares itself to a bank that survives a robbery without touching depositors' accounts.
WhyBinance wants to stop withdrawals from turning into a run. It also wants to keep its top market share and avoid new regulatory demands. It is the victim of the theft and is working with the FBI and the Secret Service[8].
Impact on themBinance's reported assets fell from $144.90 billion before the hack to $128.87 billion after[5]. Its emergency funds and treasury took a loss of about $6 billion[3]. Its Tuesday proof-of-reserves report will show whether its stated backing holds up[5].
Frames it asThe FBI treats the theft as a state attack on the financial system, not ordinary crime. It says that naming the culprit quickly lets the industry block the stolen funds. It has observed TraderTraitor converting the loot into Ethereum. It expects the funds to be laundered through decentralized finance (DeFi) platforms and instant swap services, and it urged firms to block the linked wallet addresses[2][24].
WhyLaw enforcement wants to freeze as much of the loot as possible before it is laundered. It also wants to cut off what it describes as a source of hard currency for North Korea's weapons programs[9][10].
Impact on themAbout $3 billion has been frozen or located so far[8]. Earlier cases show recovery is hard. Much of the $1.5 billion stolen from Bybit in 2025 was laundered[22].
Frames it asCritics argue that repeated large thefts by one state actor show weak security and weak oversight across the industry. After the Bybit theft in 2025, Sens. Elizabeth Warren and Jack Reed pressed the Treasury Department and the Justice Department on what they were doing about North Korean crypto theft[18]. Critics also note Binance's history. Zhao pleaded guilty to a money-laundering-related charge and was pardoned by President Trump in October 2025. Before the pardon, an Emirati state-backed fund used the Trump family's World Liberty stablecoin to complete a $2 billion investment in Binance[16][17]. Our searches did not find a Warren statement about this specific hack.
WhyThese critics want stricter federal rules for crypto, and they want any crypto legislation to include safeguards against conflicts of interest[17].
Impact on themThe hack may shape the crypto-bill debate in Congress. In this bounded search, we found no new legislation tied directly to the hack.
Frames it asWe found no public statement from Pyongyang about this hack. In past cases, North Korea has denied that it runs crypto theft operations. It calls U.S. accusations hostile propaganda[20].
WhyAnalysts quoted across outlets say crypto theft gives the heavily sanctioned state foreign currency for its economy and its nuclear program[9][21].
Impact on themIf about $3 billion stays frozen, the regime's net take shrinks sharply. U.S. sanctions pressure may also increase[8][2].
Frames it asTraders saw the reopening as a stress test that so far is not becoming a panic. Crypto trade press reported that bitcoin briefly slipped toward $76,700, stayed above the closely watched $75,000 level, and traded near $78,000 on Monday[4]. Some analysts see bitcoin stabilizing if withdrawals keep going smoothly[4]. Others are watching whether outflows speed up[23].
WhyInvestors want to know that exchange balances are real and can be withdrawn. They also want to gauge contagion risk before the week's U.S. midterms and jobs data[23].
Impact on themUsers have moved billions off Binance[1]. Trade press frames the week ahead around the Binance fallout, the U.S. midterms and the jobs report[23].
Like this article?
The Bias Ledger average rating 3.7
The same story, as framed by outlets across the spectrum, ordered least to most biased. The bias score (1 = straight, 10 = heavily spun) is an AI assessment of that framing — click an outlet to see its track record. The tell is the word choice or omission that reveals the angle.
| Outlet | Vantage | Bias | How they frame it | The tell |
|---|---|---|---|---|
| Associated Press | U.S. center | 2 | FBI blames North Korea for stolen billions from Binance in biggest hack in history | Mostly straight. It reported the 90% replaced figure, which differs from the 95% other outlets used. It also links the hack to the earlier Bybit theft by the same group. |
| Bloomberg | U.S. center / markets | 3 | Binance Outflows Hit $4.7 Billion After Record North Korea Hack | Leads with outflows, the number markets care about most. The number comes from a Binance spokesperson, so it is the company's own figure. |
| Fox Business | U.S. right | 3 | FBI says North Korea stole over $6 billion in Binance crypto hack | Frames the story around 'the regime in Pyongyang' and the national-security angle. We found no mention of the Trump-Binance ties or the pardon. |
| Al Jazeera | Qatari state-funded | 3 | FBI blames North Korea for record $6.3bn crypto heist from Binance | Attributes the finding carefully to the FBI ('blames'). It emphasizes the record scale and the weapons-funding context. |
| South China Morning Post | Hong Kong, owned by Alibaba | 4 | Binance sees spike in withdrawals as exchange returns online after US$6.3 billion hack | 'Spike' stresses alarm without giving the outflow as a share of total assets. |
| Benzinga | U.S. retail-investor / crypto trade | 5 | '98% Chose to Stay': Binance Hack Continues to Be Probed by Secret Service as Changpeng Zhao Touts 'Trust' | Puts the founder's self-reported statistic in the headline. The word 'touts' adds some distance, but the reassuring number still sets the frame. |
| Bitcoin.com News | Crypto industry trade site | 6 | Binance Has Shed $16B Since The Hack as Its Proof Lands Tuesday | 'Shed $16B' appears to combine the theft, withdrawals and price moves into one alarming number that is larger than the net outflows. |
References
- Binance Outflows Hit $4.7 Billion After Record North Korea Hack — Bloomberg · U.S. business/financial news, owned by Michael Bloomberg; markets-centrist
- North Korea Responsible for $6 Billion+ Binance Attack — FBI · U.S. federal law enforcement agency; primary source
- Binance withdrawals resume following $6 billion hack — CNN · U.S. center-left commercial network
- Binance Reopens Bitcoin Withdrawals After $6.3B Hack, Says 95% of Stolen Crypto Replaced — CoinCentral · Crypto-industry trade site, ad-funded
- Binance Has Shed $16B Since The Hack as Its Proof Lands Tuesday — Bitcoin.com News · Crypto-industry trade site owned by a crypto company
- North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History — TRM Labs · Private blockchain-intelligence firm with government and industry clients
- Binance links $6.3 billion crypto theft to compromised DevOps laptop — BleepingComputer · Independent U.S. cybersecurity trade publication
- Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History — Yahoo Finance · U.S. commercial financial portal, owned by Apollo
- FBI blames North Korea for record $6.3bn crypto heist from Binance — Al Jazeera · Qatari state-funded broadcaster
- FBI says North Korea stole over $6 billion in Binance crypto hack — Fox Business · U.S. right-leaning business network (Fox Corp.)
- FBI blames North Korea for stolen billions from Binance in biggest hack in history — Associated Press · U.S. nonprofit wire cooperative; center
- Binance opens crypto withdrawals in phases starting with bitcoin following $6.3 billion hack — CoinDesk · Crypto-industry trade outlet, owned by Bullish (a crypto exchange)
- Binance Processes $4.65B in Withdrawals Across 15 Networks After Hack — Bitcoin.com News · Crypto-industry trade site owned by a crypto company
- '98% Chose to Stay': Binance Hack Continues to Be Probed by Secret Service as Changpeng Zhao Touts 'Trust' — Benzinga · U.S. retail-investor financial news site
- Binance Hack: CZ Credits FBI for Saving Bitcoin From a Bigger Crash — Coinpaper · Crypto-industry trade site
- Trump pardons convicted Binance founder Changpeng Zhao — CNBC · U.S. business network (NBCUniversal/Versant); markets-centrist
- Trump pardons convicted Binance founder Changpeng "CZ" Zhao — Axios · U.S. center, commercial (owned by Cox Enterprises)
- Warren, Reed Press Treasury and DOJ on North Korea's $1.5 Billion Crypto Heist — Office of Sen. Jack Reed · Democratic senators' official release; advocacy
- Binance sees spike in withdrawals as exchange returns online after US$6.3 billion hack — South China Morning Post · Hong Kong daily owned by Alibaba Group
- N. Korean hackers blamed for record $6.3b Binance cryptocurrency theft: US firm — The Korea Herald · South Korean English-language daily, commercial (Herald Corp.)
- Blockchain intelligence firms link North Korea to $6.3B hack on Binance — NPR · U.S. public broadcaster; center-left audience
- North Korea Bybit hack: Ethereum, Safe, DPRK Lazarus Group TraderTraitor — Fortune · U.S. business magazine, privately owned; center
- Binance hack fallout, U.S. midterms and jobs report: Crypto Week Ahead — Cryptonews.net · Crypto-industry news aggregator
- FBI links $6.3 billion Binance crypto heist to North Korean hackers — BleepingComputer · Independent U.S. cybersecurity trade publication
- FBI Blames North Korea for $6.3 Billion Binance Hack — The Epoch Times · U.S. right, affiliated with the Falun Gong movement
- Binance says vast majority of stolen $6.3B replaced from hack that FBI blames on North Korea — CBC News · Canadian public broadcaster; carrying AP reporting