Binance Says Withdrawals Are Stabilising After $6.3 Billion Hack as Services Resume

Binance says withdrawals are stabilising after customers removed billions of dollars from the exchange following last week's $6.3 billion cryptocurrency theft. In a Monday, November 2, report, Reuters said the company had resumed service in stages and described net customer withdrawals of $3.64 billion, or about 2.1% of its assets. Binance also said it had covered 95% of the digital tokens stolen in the breach. Those are major new operational and financial developments since the initial disclosure of the attack on October 30.

The distinction matters for users: an exchange announcing a hack, reopening withdrawals and saying it has replaced most stolen assets are three different stages. Monday's information addresses what customers can do and how the company is responding, rather than simply repeating the original theft figure. It does not mean every token has been restored or that every customer can withdraw every asset without restriction.

Customers withdraw billions as access resumes

Reuters reported that Binance customers pulled a net $3.64 billion after service resumed, based on the company's figures. The exchange said withdrawals had initially risen sharply but were now stabilising, while deposits remained substantial. The company also reported $171 billion in total assets under management as of October 28. Taken together, those numbers indicate a large withdrawal response without proving that the platform had experienced a complete run on its assets.

There is an important measurement disagreement. Crypto analytics service DefiLlama showed outflows of $5.81 billion, higher than the company figure. Binance argued that some transfers to its own new wallets were included in outside estimates and that the company's measure was closer to the relevant customer-flow total. The disagreement is not a minor footnote: readers should not treat one number as universally accepted when the data sources use different accounting boundaries.

A phased return, not a blanket restoration

Binance said withdrawals were being restored in stages according to demand. The first phase covered 15 tokens, including bitcoin, ether and certain stablecoins and dogecoin-related withdrawals. The list does not establish that every asset or every account had identical access at the same moment. Users should check the exchange's live notices for the specific asset and network they intend to use.

The exchange said it had replaced roughly 95% of the stolen tokens, using company resources to purchase replacement assets. The remaining portion involved less-liquid tokens that could take longer to source. Reuters reported that Binance had set aside about $6.34 billion of company funds to absorb the impact, drawing on reserves including its Secure Asset Fund for Users and other corporate resources. A commitment to cover losses is significant, but it should not be confused with a completed independent audit of every affected account.

Attribution to North Korea remains disputed publicly

The FBI said on Saturday that a North Korean state-sponsored group known as TraderTraitor was responsible for the theft. Blockchain analysis firms also pointed to North Korean involvement, Reuters reported. The North Korean government has historically denied conducting state-linked cyber thefts. US President Donald Trump said over the weekend that Washington was not certain of North Korea's role.

Those statements should be presented as attributed positions rather than compressed into a single uncontested verdict. The FBI's assessment is a serious law-enforcement finding, but the public political response was not uniform. The available material also does not justify speculating about individual suspects, their private identities or the exact mechanism of every transaction beyond what investigators have disclosed.

Why the recovery numbers matter to the wider market

Bitcoin and ether prices had fallen during the initial reaction to the breach before recovering some ground. Reuters reported bitcoin trading above $78,000 on Monday and ether around $2,287. Those are market snapshots, not forecasts. A security incident at a major exchange can affect confidence in custody and liquidity even for investors who did not hold assets on the affected platform.

The response is also a test of whether an exchange can maintain operations while replacing missing assets. Customers may judge that response through withdrawal availability, clear communication and the handling of affected balances. The amount stolen is a headline measure of the incident's scale; the speed and completeness of restoration are the operational measures that matter after the initial shock.

Users should watch for impersonation scams

Binance warned of scams emerging during the confusion surrounding the breach. That is a practical consequence of the story: attackers may exploit genuine uncertainty by circulating false recovery forms, support messages or promises of expedited withdrawals. Users should use official exchange channels and avoid sending seed phrases or private keys to anyone claiming to help recover funds. The existence of a real incident does not make an unsolicited recovery offer legitimate.

As of Monday morning, the verified new development is that withdrawals have resumed in phases, the company says outflows are stabilising, and 95% of the stolen tokens have been covered. Questions remain about the final recovery, the reconciliation of flow estimates and the investigation. Those are the next meaningful checkpoints, rather than another repetition of the original $6.3 billion theft headline.

Sources reviewed: www.reuters.com, nowlivo.com. Reporting reflects information available on the morning of 2 November 2026 (IST).