When news broke that Binance users withdraw $3.6 billion within days of the largest crypto exchange hack ever recorded, the story spread well beyond finance circles. Social feeds, news sites, and group chats all picked it up. The headline number is real, but it is easy to misread. It is a net outflow, it sits next to a larger gross figure, and it follows a theft of about $6.3 billion. This guide separates what is confirmed from what is still unproven, with dates throughout.
After a hack on October 29, 2026, Binance froze withdrawals and then reopened them in phases on November 1. Customers withdrew more than $4.6 billion, and about $1 billion came back in as deposits. That left a net outflow of $3.64 billion, which Binance said was about 2.1% of its $171 billion in total assets.
What Happened: The Biggest Crypto Hack in History
On the evening of Thursday, October 29, 2026, an attacker began moving huge amounts of crypto out of wallets operated by Binance. Reports say the wallets were emptied overnight across about ten blockchains. Binance confirmed on October 30 that roughly $6.3 billion had been drained, which made it the largest crypto theft on record.
For scale, Binance is, according to CBS News, the world’s largest crypto exchange, with more than 300 million users. Reuters, citing its 2024 annual report, put its registered users at more than 335 million, with about $160 billion in assets under custody. A theft of this size at a platform of this size is why the Binance users withdrawing $3.6 billion story became a global headline.
Timeline of the Binance Hack and Withdrawals
| Date (2026) | Event | Status |
| Oct 29 (Thu) | The attacker moves funds out of Binance-operated wallets. | Confirmed |
| Oct 30 | Binance puts total impact at about $6.3B; about $3B is reported frozen. | Confirmed (Binance estimate) |
| Oct 30 | TRM Labs attributes the attack to TraderTraitor with “high confidence.” | Attribution by a blockchain intelligence firm |
| Oct 31 (Sat) | The FBI says North Korea is responsible and that stolen assets are being converted mainly into Ethereum. | Confirmed (US agency statement) |
| Nov 1 (Sun) | Phased withdrawals reopen; Binance says about 95% of the impacted amount is covered. | Confirmed (company statement, reported by media) |
| Nov 2 (Mon) | Binance reports a $3.64B net outflow. | Confirmed (company post, reported by CBS) |
How Much Was Stolen? Asset-by-Asset Breakdown
Early on-chain estimates moved around while funds were still leaving. Blockchain firm TRM Labs published an initial breakdown, which a secondary report reproduced with data as of October 30, 2026, 00:30 UTC:
| Asset / chain | Initial estimate (USD) |
| Ethereum network assets (ETH, USDT, USDC, RLUSD) | about $3.79B |
| Bitcoin (about 18,270 BTC) | about $1.47B |
| Tron (USDT, TRX) | about $628M |
| XRP Ledger (about 233 million XRP) | about $296M |
| Solana (about 970,500 SOL) | about $96M |
| Five other chains | about $77M |
| Total | about $6.36B across 10 networks |
Source: TRM Labs data as reproduced by pasqualepillitteri.it. Binance’s own estimate was about $6.3B. Treat these as early estimates that could be revised.
Another analysis, citing TRM Labs, reported that the theft took under four hours, with most of the crypto gone in about 20 minutes. That speed is why people call it the most dramatic crypto exchange hack to date.
How Did the Hackers Get In? What Is Confirmed and What Is Not
Binance has not yet published a full technical post-mortem, though it has promised one. What is publicly known so far:
- Reported, not fully confirmed: Gizmodo reports that Binance’s first public explanation pointed to a laptop belonging to a DevOps engineer.
- Under investigation: Bitdefender’s security blog says investigators are examining whether a compromised engineer’s laptop enabled the withdrawals.
- Analyst observation: TRM Labs said several features of the attack match earlier North Korea-linked heists, including the Bybit hack.
Until Binance releases its own findings, treat any claim about exactly how the breach happened as preliminary.
Why Binance Users Withdraw $3.6 Billion: The Numbers Explained
Here is why you will see several different numbers for the same event.
Gross vs. Net: Binance Users Withdraw $3.6 Billion in Net Terms
Binance’s own post, as reported by CBS News, says customers withdrew more than $4.6 billion. CBS also reports that customers deposited just over $1 billion, which produced the $3.64 billion net outflow.
| Reported figure | Source | What it likely measures |
| $3.6B / $3.64B | Binance (via CBS, Qazinform, others) | Net outflow after deposits |
| More than $4.6B | CBS News, Yahoo Finance | Gross withdrawals |
| About $4.7B | Khaleej Times | Gross withdrawals (slightly different measure) |
| More than $3.5B | DefiLlama (via Digg) | Net outflow from on-chain wallet data |
The figures are not contradictory. They measure different things, and the Binance users withdraw $3.6 billion, which is the net one. One Australian outlet printed a figure of about 5.1 billion, but that appears to be an Australian-dollar conversion of the same US $3.6 billion, not a separate number.
Binance Users Withdraw $3.6 Billion: What Share of Total Assets Is That?
Binance said the amount represents just 2.1% of its $171 billion in total assets. Gizmodo, using DefiLlama wallet-flow data, calculated a different share: roughly 3.6% of the $171 billion Binance reported holding before the attack. The gap comes from different methods and different underlying figures, so I’d quote both and name each source. Is $3.6 Billion a Lot? Context for the Binance User Withdrawal $3.6 Billion Headline
It is large in absolute terms but, by Binance’s own measure, small against its balance sheet. Binance said the flow of funds out eased after an initial spike. A smaller-than-feared outflow is not proof that confidence is fully restored. Institutional investors in particular are reassessing security risks, according to analysts.
How Binance Responded to the Crypto Exchange Hack
Freezing Withdrawals
Binance paused withdrawals after the breach. Khaleej Times reports the freeze lasted about 48 hours, with withdrawals reopening on Sunday morning.
Recovering and Freezing Stolen Crypto
Binance said roughly $3 billion of the stolen assets were frozen. CBS explains that freezing works because certain token issuers can block their tokens from moving anywhere in the world. Freeze estimates varied during the first hours, from about $2.54B to about $3B depending on the source and timestamp. Not all stolen crypto can be frozen this way, and some of it can be swapped into other assets.
Covering the Losses: Binance Promises Users Won’t Pay
Binance said it would absorb the loss rather than pass it to customers. The company said it had covered about $6 billion of the $6.3 billion by using company money to buy replacement tokens. CBS reported a 95% coverage figure on Sunday. An earlier report had cited 90%, which looks like an earlier snapshot of the same process.
A Phased Restart for Withdrawals
Binance scheduled the first phase for 2 to 5 p.m. Singapore time, covering 15 crypto assets. Reopening in stages is a common way to limit panic and let the platform check its systems as volume returns. This is why people searched “Binance withdrawals resume” so heavily over the weekend.
North Korea and TraderTraitor: Confirmed vs. Claimed
This is the part of the story where accuracy matters most.
Confirmed by a US agency: The FBI posted that North Korea was responsible for the theft of more than $6 billion from Binance on or about October 29, 2026. It refers to the activity as “TraderTraitor.” The FBI also said it, together with the USSS and IRS-CI, observed the group converting the stolen assets primarily into Ethereum.
Attribution by private analysts: TRM Labs said it attributes the attack to TraderTraitor with high confidence. Several features, it said, match earlier North Korea-linked heists, including the Bybit hack.
Not established: No named individuals have been identified in the sources I reviewed, and I won’t speculate about any. Claims about specific laundering routes beyond what the FBI and blockchain firms have published should be treated as unverified.
The FBI also encouraged private companies to block transactions tied to the addresses these actors are using to launder the stolen assets.
Was This a Bank Run? What Analysts Say
A headline like “Binance users withdraw $3.6 billion” invites comparison with a bank run. The reporting so far suggests a more mixed picture:
- Analysts quoted by Cyprus Mail described the outflows as relatively modest.
- Binance says the flow slowed after the first surge.
- Roughly $1 billion in new deposits arrived over the same period, according to CBS.
- Wealth-industry coverage has pointed to urgent custody and suitability questions for financial advisors. The fair reading is that confidence was shaken, but the platform did not collapse. How long that holds depends on what the post-mortem shows and whether the remaining stolen funds are recovered or frozen.
Confirmed Facts vs. Rumors: A Quick Reference Table
| Claim | Status |
| About $6.3B stolen on Oct 29, 2026 | Confirmed (Binance estimate; TRM Labs about $6.36B) |
| Net outflow of about $3.64B after withdrawals resumed | Confirmed (Binance post, reported by CBS) |
| North Korea is responsible. | Stated by the FBI; attributed to TraderTraitor |
| About $3B frozen | Binance figure; estimates varied over time. |
| About 95% of losses are covered by Binance. | Company statement |
| The hack began with a compromised engineer’s laptop. | Reported and under investigation, not final |
| Binance will not pass losses to users. | Company promise, not a legal guarantee |
| Binance is insolvent or will collapse. | No evidence in sources reviewed. Treat as rumor |
| All stolen funds will be recovered. | Not established. About $3B reported frozen; the rest unresolved. |
How This Compares With the Bybit Hack
The most obvious comparison is the Bybit hack of February 2025. Both attacks are linked by the FBI to TraderTraitor, and the FBI has said the group was behind the February 2025 attack on Bybit, a $1.5 billion loss.
| Factor | Bybit (Feb 2025) | Binance (Oct 2026) |
| Amount stolen | About $1.5B | About $6.3B |
| Attributed to | TraderTraitor (FBI) | TraderTraitor (FBI) |
| Scale vs. the other | Baseline | Roughly four times larger (simple arithmetic) |
| Post-hack user reaction | Not covered in my sources | Net outflow of about $3.64B |
The sources I reviewed do not give comparable user-reaction numbers for Bybit, so I haven’t made claims there.
What Crypto Holders Can Do Now: General Safety Tips
This is general information, not financial or legal advice. I’m not a financial advisor, and your risk tolerance is your own.
Practical security habits that apply on any exchange:
- Turn on two-factor authentication, preferably with an authenticator app or hardware key.
- Use an anti-phishing code if your exchange offers one. Scammers often exploit big news like this.
- Enable a withdrawal address whitelist if available.
- Be wary of “compensation” or “recovery” messages. Check them only through the official app or site.
- Don’t keep more on any single platform than you are comfortable risking.
- If you move funds off an exchange, double-check every address and test with a small amount first.
Questions to ask yourself before moving funds:
- Do I actually need to move, or am I reacting to headlines?
- Do I understand the fees and the security risks of self-custody?
- Is the platform I’m moving to well established?
The fact that Binance users withdraw $3.6 billion does not mean you should do the same. Each person’s situation differs.
What to Watch Next
- The post-mortem: Binance has promised a detailed technical report. That will settle the open question of how attackers got in.
- Laundering and freezing: The FBI says stolen assets are being converted into Ethereum. Whether more can be frozen will shape how much Binance ultimately absorbs.
- Net flows over time: Watch whether deposits and withdrawals stabilise. DefiLlama and Binance’s own posts are the likeliest sources.
- Regulatory and institutional responses: Reports note that advisors and institutions are rethinking custody risk. Concrete policy responses are not confirmed in my sources.
- Final coverage numbers: Reports of 90%, 95% and about $6B covered are snapshots of a moving process.
FAQS
Did Binance users withdraw $3.6 billion after the hack?
Yes, as a net figure. Binance reported a net outflow of about $3.64 billion after withdrawals reopened on November 1, 2026. Gross withdrawals exceeded $4.6 billion, offset by roughly $1 billion in deposits.
How much was stolen in the Binance hack?
Binance estimated about $6.3 billion. TRM Labs put its early on-chain total at about $6.36 billion across ten blockchains.
Who is blamed for the Binance hack?
The FBI said North Korea was responsible, referring to the activity as TraderTraitor. TRM Labs attributed it to the same group with high confidence.
Are my funds on Binance safe?
Binance said it would cover losses and that user funds were safe. That is a company statement, not a legal guarantee. I can’t assess your individual risk.
How much of the stolen crypto was frozen?
Binance said about $3 billion was frozen. Earlier estimates during the first hours were lower, around $2.54 billion, and varied by source.
Is this the biggest crypto hack ever?
Multiple outlets and security experts describe it as the largest crypto theft on record. It is roughly four times the $1.5 billion Bybit hack in February 2025.
Has Binance explained how the hack happened?
Not fully. Binance’s early explanation pointed to a DevOps engineer’s laptop, and a technical post-mortem is promised.
Why do different websites report different withdrawal totals?
Some report gross withdrawals ($4.6B to 4.7B),othersreportnetoutflows(3.6B), and some convert to other currencies. DefiLlama’s wallet-flow figures differ again.
Final Thoughts
The story that Binance users withdraw $3.6 billion after the biggest crypto heist on record is dramatic, but the numbers need care. The $3.64 billion is a net figure. Binance says it is about 2.1% of total assets, while independent analysis puts it near 3.6%. The FBI and blockchain firms point to North Korea’s TraderTraitor, but how the breach happened is still being investigated. Binance has promised to absorb the losses, and the outflow reportedly slowed after the first surge. The next real answers will come from the technical post-mortem, the recovery of frozen funds, and whether deposits and withdrawals settle into a steady pattern.
