Customers pulled a net USD 3.64 billion from Binance over a 9.5-hour period on Sunday, when the platform partially resumed withdrawals following the attack.
Although the outflow highlights concerns about the security of customer funds, analysts have described the withdrawals as relatively modest compared with previous crises in the cryptocurrency industry.
The scale of the withdrawals is an early indication of whether Binance can retain customer confidence following what could be the biggest financial heist in cryptocurrency history.
For comparison, approximately USD 7 billion was withdrawn from the USDC stablecoin over a week during the collapse of Silicon Valley Bank in 2023.
The FTX cryptocurrency exchange also experienced withdrawals of around USD 6 billion over 72 hours in 2022, shortly before its collapse.
Binance said the latest net outflow represented 2.1% of its assets, suggesting that the incident had not triggered widespread withdrawals across its customer base.
“Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations,” Binance co-CEO Yi He said in a post on X on Monday.
While combatting the USD 6.3 billion security breach allegedly choreographed by North Korean-based hackers, the exchange has also reassured customers that it is restoring its operations and security arrangements, stating it has sufficient financial resources to cover the losses.
Binance said it was covering the USD 6.3 billion in losses and had already raised USD 6 billion through its corporate treasury, an insurance fund, and a separate fund designed to address security breaches.
The company also said withdrawal activity had eased following an initial surge.
“After an initial spike, withdrawal volumes have declined and are stabilising,” Binance said on X, adding that approximately USD 1 billion in deposits had flowed into the platform against USD 4.6 billion in withdrawals on Sunday.
The exchange, which says it has well over 335 million users globally and handles an average daily trading volume of USD 95 billion across digital assets and derivatives, remains a central player in the cryptocurrency market.
Several traders told Reuters they were not planning to immediately withdraw their funds from Binance, reflecting the continued importance of centralised exchanges for liquidity, trading, and access to cryptocurrency markets.
Jay Koh, vice president of the Singapore-based Asia Web3 AI Association, said he would not necessarily withdraw all his holdings from Binance despite the security breach.
“Centralised exchanges continue to play an important role in providing liquidity and access to digital assets,” he said.
Ryan Tan, a Binance customer, also said he was in no hurry to withdraw his remaining funds. However, he added that his exposure to the platform had already been limited following the collapse of FTX in 2022.
“After the FTX collapse, I decided to hold everything on my wallet instead of leaving them on exchanges,” said the 39-year-old.
The attack has nevertheless unsettled cryptocurrency markets, with trading volumes rising as investors reassess their exposure to digital assets.
Bitcoin, which touched a six-week low on Friday, recovered over the weekend and traded above USD 78,000 on Monday. Ether also rebounded from a two-month low.
However, stablecoin market capitalisations have declined since Friday, with a section of analysts guessing whether investors may be shifting towards cash or traditional assets.
Talking about the North Korea link with the Binance attack, the US Federal Bureau of Investigation (FBI) said on Saturday that a state-sponsored hacking unit, known as TraderTraitor, was responsible for the attack on Binance.
The incident is the largest in a series of recent cryptocurrency thefts attributed to North Korean hackers.
Researchers describe TraderTraitor as an experienced and highly capable cybercriminal operation, with stolen funds believed to help finance North Korea’s weapons programmes.
Binance has gradually restored withdrawal services for selected digital assets and blockchain networks. Bitcoin withdrawals have resumed through the Bitcoin network, while ether and some dollar-backed stablecoins can be withdrawn through the Ethereum network.
The exchange also restored US dollar cash withdrawals on Monday. However, its website continued to show partial withdrawal suspensions for most other cryptocurrencies.
Beyond the immediate customer withdrawals, analysts believe the attack could temporarily slow institutional investment in cryptocurrencies, particularly as large investors become more sensitive to cybersecurity risks.
The incident comes at a time when institutional participation, including through spot bitcoin exchange-traded funds (ETFs), has been viewed as an important potential driver of cryptocurrency prices.
Spot bitcoin ETFs recorded USD 643 million in outflows on Friday, their largest single-day withdrawal in October.
More than USD 1.3 billion in leveraged positions were also liquidated, according to Ari Redbord, global head of policy at US blockchain analytics firm TRM Labs.
“A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people’s capital,” Redbord said.
Approximately half of the stolen funds were held in stablecoins. Issuers, including Circle, have frozen some of the assets. Circle said on Monday that it had frozen more than USD 1.1 billion in USDC.
Jonathan Benton, founder and chief executive of the asset recovery firm iSanctuary and a former head of the UK’s National Crime Agency international corruption unit, said technology existed to trace stolen digital assets.
However, the bigger challenge was converting that information into rapid, coordinated action before the funds could disappear.
“The future of crypto won’t be decided by how much money enters the market, but by how safe that money is once it’s there,” Benton said.
