Binance Withdrawals Resume; Net Outflow of $3.6B in 9 Hours

Binance reopened withdrawals on Sunday (1st), and between 6:00 AM and 3:30 PM GMT, processed $4.649 billion in withdrawals against $1.01 billion in deposits, according to figures released by the exchange and reported by Reuters. The net outflow of $3.64 billion is equivalent to 2.1% of the platform's assets. This is the first liquidity test following the theft of approximately $6.3 billion that occurred on October 29, marking the largest heist ever recorded against a cryptocurrency exchange.

Nine and a Half Hours of Stress

The reopening was phased. According to co-CEO Richard Teng, Bitcoin and assets from 15 other blockchains were released first, and the unlocking of the remaining assets depends on security checks and stability. The company warned that some users may experience slower processing as the queue is addressed.

Ari Redbord from TRM Labs stated that the withdrawal volume suggests "a preventive reaction rather than capital flight." The BBC, based on the same data, reported that the initial surge in requests weakened throughout the day and that flows were "stabilizing as expected," according to the exchange. A 2.1% outflow in a single day is significant for any financial institution but is far from the flight patterns that have previously affected exchanges.

What is Known About the Attack

On Saturday (31st), the FBI attributed the operation to a group linked to North Korea known as TraderTraitor and released hundreds of addresses in Ethereum, Bitcoin, and Solana, urging companies in the sector to block transactions connected to them. In February 2025, the same FBI attributed the $1.5 billion theft from Bybit to Pyongyang, which was previously the record. The new case is more than four times larger.

Binance's preliminary investigation points to a compromised laptop belonging to a DevOps engineer, which reportedly allowed the attacker access to a service container and enabled unauthorized withdrawal transactions. The company asserts that it has not found evidence of a leak of private keys from the wallets. Teng later stated that the attack was not a "one-click" action and that the attacker did not limit themselves to the permissions of a single engineer.

Who Pays the Bill

Binance claims that customers will not bear the loss. Teng stated that the exchange replenished most of the stolen assets using its own resources, combining corporate treasury, the SAFU (Secure Asset Fund for Users), and the futures market insurance fund. The company did not specify how much came from each source, and reports published since Friday have differed regarding this allocation. Without this detail, the market cannot assess how much of the customer protection cushion has been consumed.

For those monitoring the sector from the United States, the FBI's attribution has immediate practical effects: the list of addresses becomes compliance inputs for any custodian, bank, or fintech processing cryptocurrency transfers. In South Korea, where the same ecosystem of North Korean groups has previously attacked local exchanges, the interpretation is of continuity. In Brazil, banks and fintechs that have begun offering cryptocurrency custody to retail clients inherit the same screening obligations without the monitoring scale of Binance.

The Lesson is in the Pipeline, Not in the Vault

The most relevant data for a corporate CISO is the vector. For a decade, exchange security has centered around the protection of private keys, with cold wallets and multi-signatures. In the two largest thefts on record, $1.5 billion at Bybit and $6.3 billion at Binance, the entry point identified was the workstation of someone with access to the operational infrastructure. In the Bybit case, investigations published in 2025 pointed to the machine of a developer from Safe{Wallet}, the provider of the multi-signature wallet.

This pattern applies to any company that automates payments, settlements, or deployments from containers with privileged credentials: the attacker does not need the key if they can get the system to sign on their behalf. The test that remains for Binance is not the one from Sunday, but the reopening of the assets that are still locked, when it will become clear whether the confidence measured in nine and a half hours can sustain itself over weeks.