Massive Outflow as Binance Reopens
Customers of the world's largest cryptocurrency exchange pulled more than $3.6 billion (roughly £2.7 billion) in assets from their accounts on Sunday, the first day Binance resumed operations after halting all transactions in the aftermath of a devastating cyber intrusion. The breach, which targeted $6.3 billion worth of digital assets, was described as the single largest hack ever recorded in the history of digital finance.
In a statement posted on the social platform X, Binance confirmed that an "initial spike" in withdrawal requests was observed when the exchange came back online. The company noted that the wave of outflows subsequently tapered off and that activity levels were "stabilising as expected." Binance also confirmed that withdrawals for high-profile tokens such as Bitcoin and Ethereum had been restored, with additional services set to return in a phased manner once internal security audits are fully completed.
The exchange had previously committed to making all affected users whole, covering every dollar lost to the attack. By the time of its reopening announcement, Binance said it had already sourced approximately 95 percent of the stolen value, though it acknowledged that the remaining balance could require additional time to replace.
North Korea Accused of Record-Breaking Cyber Attack
The Federal Bureau of Investigation (FBI) and other major law-enforcement and intelligence bodies have pointed the finger squarely at North Korea as the mastermind behind the assault. The attribution places the incident squarely in the realm of state-sponsored economic espionage, a pattern in which Pyongyang's cyber units have repeatedly targeted financial institutions and digital-asset platforms to fund the regime's weapons programmes.
The scale of the theft — $6.3 billion — dwarfs every previous cryptocurrency heist and underscores the growing threat that well-resourced, government-backed hacking groups pose to the digital-asset ecosystem. Analysts and security researchers have long warned that the concentration of trillions of dollars in crypto holdings at a handful of centralised exchanges makes them especially attractive targets for such operations.
How the Breach Unfolded
Binance disclosed last week that preliminary forensic work suggested the intrusion may have originated with a laptop belonging to one of the company's engineers that had been compromised. Once in possession of the device, the attackers allegedly exploited access to engineer credentials to execute unauthorised transactions on the platform.
The attack struck Binance's global centralised exchange at Binance.com. The company's separate U.S.-facing platform, which operates under different regulatory and technical arrangements, confirmed it was not impacted by the incident.
Binance emphasised that the $3.6 billion in post-hack withdrawals represents only a small slice of the total value the platform holds on behalf of its users. In 2024, the exchange reported that assets under its custody exceeded $160 billion, a figure that highlights both the enormous scale of the operation and the relatively contained nature of customer panic in the immediate aftermath of the breach.
Context: Binance's Scale and the Crypto Landscape
Binance was originally established in China before relocating its headquarters and now serves hundreds of millions of registered users across the globe. It remains the dominant venue for buying, selling, and trading cryptocurrencies — digital assets that exist purely in electronic form on computers, smartphones, and other devices, with no physical counterpart.
The latest incident is likely to intensify regulatory scrutiny of how large exchanges store and safeguard customer funds, and it is expected to fuel ongoing debates about the resilience of centralised platforms in the face of sophisticated, state-backed cyber threats.
