Binance, the world’s largest cryptocurrency exchange, processed $4.72 billion in customer withdrawals on Monday. This activity occurred one day after the platform resumed operations following a security breach estimated at $6.3 billion. The company confirmed that deposit volumes exceeded withdrawal amounts during this period.
Withdrawal patterns and asset stability
The exchange began allowing customers to withdraw funds again on Sunday, ending a freeze that lasted approximately 48 hours post-breach. Binance stated that net outflows represented roughly 3% of assets held on the platform. Analysts viewed this relatively modest percentage as an indicator that customer confidence remained largely intact.
Most of the withdrawn capital consisted of USDT, the stablecoin issued by Tether. On Monday, Binance reported seeing $2.7 billion in inflows from customers since Sunday. The firm noted that withdrawal volumes had begun to stabilize after an initial spike.
North Korean attribution and financial impact
The Federal Bureau of Investigation (FBI) identified North Korea as responsible for the hack. Pyongyang denied these allegations. On Saturday, the FBI named the state-sponsored group TraderTraitor as the perpetrator. Researchers describe this entity as highly sophisticated, noting its activities help fund the country's weapons programs.
TRM Labs, a blockchain analytics firm, reported that hackers linked to North Korea have stolen $7.4 billion in 2026. This incident marks an escalation in cryptocurrency thefts associated with the nation. Approximately half of the stolen funds were held in stablecoins. Issuers such as Circle froze these assets; Circle announced on Monday it had frozen over $1.1 billion in USDC.
Market response and recovery efforts
Bitcoin recovered over the weekend to trade near $78,000 on Monday, after hitting a six-week low on Friday. Ether also rose following a drop to a two-month low. Market capitalizations of stablecoins declined since Friday, suggesting some investors moved funds into cash or traditional assets. Binance resumed dollar withdrawals on Monday.
In a statement on X, Binance declared it would absorb the financial impact of the stolen funds rather than passing costs to users. The company said it covers losses using corporate treasury funds, insurance funds, and reserves designated for security breaches, totaling $6 billion collected so far.
By 03:00 GMT Tuesday, Binance indicated deposits per hour surpassed withdrawals, signaling stabilization in customer money flows. The platform claims more than 335 million users globally and daily trading volumes averaging $95 billion across digital assets and derivatives.
Tracking stolen assets
Elliptic, a blockchain research firm, stated that about $3.24 billion in stolen crypto assets remained in wallets linked to the theft. Elliptic characterized the money laundering process as "highly complex and clearly automated."
Jonathan Benton, founder and CEO of iSanctuary, a firm specializing in recovering crypto assets, commented on the situation. He noted that technology exists to track stolen funds. However, he identified the primary challenge as converting this information into rapid, coordinated action before the assets disappear.
