Binance Reopens After $3.6B Net Outflow Following Record $6.3B North Korean Heist

Key points

• Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits on November 1, resulting in a net outflow of $3.64 billion.
• The net outflow represented 2.1% of Binance’s total $171 billion in assets, with withdrawals stabilizing after an initial spike.
• The FBI attributed the $6.3 billion theft to North Korean cybercriminals known as 'TraderTraitor,' also linked to the 2025 Bybit hack.
• Binance stated it has covered 95% of the stolen assets using corporate treasury and insurance funds, with the remaining 5% consisting of less liquid tokens.
• President Donald Trump stated his administration is investigating the breach, noting uncertainty about North Korea's involvement but promising action if confirmed.
• Former hacker Ilya Lichtenstein warned that AI advancements make laundering stolen crypto increasingly difficult for attackers due to rapid blockchain tracing.

Background

This incident follows a series of major cryptocurrency breaches in 2025 and 2026, including the $1.5 billion theft from Bybit attributed to the same North Korean group. Binance had previously pledged to cover all losses from the October 29 breach, reserving over $6.34 billion in funds. The exchange, which holds over $160 billion in custody, suspended all transactions immediately after the hack to contain the damage.

How outlets are covering it

Binance emphasized its financial resilience, stating it covered 95% of the losses and that withdrawals are stabilizing. Fox Business highlighted the FBI's official attribution to North Korea and expert warnings about an impending 'AI hacking bloodbath.' CNBC focused on the financial metrics, noting the outflow was a small fraction of total assets. CNN featured former hacker Ilya Lichtenstein, who described the situation as 'terrifying' for attackers due to advanced blockchain analysis tools and AI-driven tracing capabilities. While all sources agree on the scale of the theft and the North Korean attribution, they differ in emphasis: Binance on recovery, Fox on geopolitical implications, and CNN on the technical challenges of laundering.

Why it matters

The breach highlights the growing threat of state-sponsored cyberattacks on financial infrastructure and the potential for AI to accelerate both hacking and defense. It underscores the vulnerability of centralized exchanges despite massive reserves and raises questions about the long-term security of digital assets in an era of advanced AI capabilities.

What to watch

Binance plans to resume services for remaining networks and assets in phases as security checks are completed. The FBI and partners are urging the industry to block transactions involving identified wallet addresses to prevent laundering. Authorities will continue tracing the stolen assets, which are expected to be converted into Ethereum and moved through decentralized finance platforms.