Binance reopened withdrawals in stages on Nov. 1 after a security incident tied by the FBI to North Korea, processing $4.649 billion in customer withdrawals by 15:30 UTC as users moved funds off the platform. Deposits totaled $1.01 billion over the same period, leaving net outflows of roughly $3.64 billion, or 2.1% of the exchange's stated $171 billion in assets under management.
The exchange said withdrawals initially resumed for 15 networks and assets. It described the early withdrawal surge as easing later in the day, while deposit activity remained elevated. The figures show substantial customer movement without approaching the scale of a disorderly run relative to Binance's reported asset base, though the episode has put renewed focus on the speed with which security breaches can turn into custody stress events.
Binance said it took a new proof-of-reserves snapshot at 00:00 UTC on Oct. 31 and had begun zero-knowledge proof calculations for an updated reserves report. Zero-knowledge proofs are a cryptographic method intended to let an exchange demonstrate that it holds specified assets without publicly exposing every wallet balance. Binance said it expected to publish the updated report on its proof-of-reserves website on Nov. 2.
FBI attributes attack to North Korea
The FBI identified North Korea as responsible for the theft from Binance, which exceeded $6 billion, according to the materials provided. Former Binance chief executive Changpeng Zhao said multiple U.S. agencies helped trace and freeze assets connected to the attack.
Blockchain security firm PeckShield put total losses from the Binance-related incident at about $6.3 billion, while reporting that roughly $3 billion in assets had been frozen. Its figures count the value initially affected and do not subtract frozen or recovered funds, a distinction that leaves the eventual realized loss dependent on asset recovery and law-enforcement action.
The size of the incident dominated crypto-security statistics for October. PeckShield recorded 56 major security events during the month, with total losses of approximately $6.48 billion. That was about 745% higher than September's roughly $766 million, almost entirely because of the Binance case.
PeckShield's year-to-date dataset placed the 10 largest incidents at around $8.6 billion in losses as of Oct. 31, equal to 92.3% of the year's total recorded losses. The concentration illustrates how a small number of large compromises can overwhelm monthly and annual security data, even when many smaller exploits occur across decentralized finance, wallet software, bridges, and centralized services.
Other large incidents listed by PeckShield included losses of about $387 million at Bitget and roughly $320 million involving Liquid Network. PeckShield reported around $285 million recovered in the Liquid Network case. Drift, KelpDAO/LayerZero and COLDCARD Wallet also appeared among the year's 10 largest attack events.
Withdrawal figures place pressure on exchange transparency
The staged reopening means customers regained access gradually rather than across all networks at once. Binance did not identify the full set of networks and assets in the initial 15-asset phase in the supplied statement, but the approach allows an exchange to monitor transaction flow and operational conditions before expanding access.
The proof-of-reserves update will be closely watched because the withdrawal activity followed an attack of unusual scale. A reserves snapshot can show assets under an exchange's control at a given time, while it does not by itself provide a complete picture of operational resilience, cybersecurity controls, liabilities outside the reported framework, or the status of stolen and frozen funds.
The difference between withdrawals and deposits provides a clearer near-term measure of customer behavior. Net outflows of $3.64 billion indicate that users withdrew more than four times the value they deposited during the reported period. Yet measured against Binance's stated $171 billion in assets under management, the withdrawals represented a limited share of the platform's reported holdings.
On-chain tracking and proof-of-reserves systems can offer rapid visibility into exchange wallet balances, but their usefulness during an incident depends on clear identification of addresses, liabilities and asset ownership. Binance's scheduled report could provide a fresh reference point following the disruption, though it will not settle questions surrounding the attack's ultimate financial impact until more is known about frozen funds and recoveries.
North Korean theft allegations renew focus on cross-chain laundering
The FBI's attribution places the attack within a longer record of alleged North Korean cryptocurrency thefts. Analyst Darkfost estimated that Lazarus Group has stolen $11.87 billion in total, citing Bank of Korea 2025 economic data to compare the figure with North Korea's gross domestic product and gross national income. Darkfost also said some stolen funds were later lost during laundering efforts.
Large thefts increasingly involve movement across several blockchains within minutes, making coordinated monitoring and asset-freezing efforts critical. U.S. Senator Cynthia Lummis said $6.3 billion in crypto assets had been stolen during the week and moved across blockchains rapidly. She said the proposed CLARITY Act would create a pilot program for direct intelligence-sharing between crypto firms and federal law-enforcement agencies.
The Binance episode arrives as governments sharpen their focus on cryptocurrency-linked financial crime. A Communist Party of China decision on strict Party governance called for action against corruption involving internet channels, virtual currencies, cross-border funds and blockchain tools. In South Korea, the Financial Services Commission scheduled a Nov. 5 emergency roundtable on AI-related cybersecurity threats in finance.
For Binance, the immediate test is operational: keeping withdrawals functioning, publishing the promised reserves update and supporting efforts to identify and freeze stolen assets. The broader aftermath will hinge on whether law enforcement and blockchain investigators can convert the reported freezes into recoveries before funds are dispersed through additional wallets, chains or intermediaries.
After Binance’s breach, understand how exchanges prove solvency with PoR. Learn more in this guide.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
