The withdrawal button worked again on Sunday morning. By Monday morning in London, $4.72 billion had left Binance.
The exchange, the largest venue for crypto trading, said the net figure covered the period since it lifted a suspension imposed after a theft late on Thursday. The assets taken were worth about $6.3 billion, the largest such loss on record. Binance said the outflows amounted to less than 3% of the $166 billion in customer assets it holds.
That percentage is the company’s argument and its problem at once. A run that takes 3% of deposits is survivable. A run that starts at 3% and accelerates is not, and the difference is whether customers believe their balances are intact. Binance has said it will cover losses from its own resources and has set aside $6.34 billion for the purpose, according to a person familiar with the response. It has also frozen about $3 billion of the stolen assets.
The FBI named the culprit on Saturday. In a statement, the bureau attributed the theft to TraderTraitor, a group it describes as state-sponsored and linked to North Korea, and asked exchanges, analytics firms and others to block transactions tied to a list of addresses. It said the group was converting stolen assets mainly into ether.
Binance’s account of the breach begins with a laptop. An engineer’s machine was compromised, giving an attacker access to an internal system and the ability to make unauthorized withdrawals, the company said. It later acknowledged additional points of entry, which is the language companies use when the first explanation turns out to be smaller than the event.
The scale has few precedents. Elliptic, a London analytics firm, put the haul at $6.3 billion, more than four times the $1.5 billion taken from a Dubai-based exchange last year, which the FBI had also attributed to North Korea. Tom Robinson, Elliptic’s chief scientist, said it was “almost certainly the largest theft of any kind in history,” which places it above the 2003 raid on Iraq’s central bank. TRM Labs, a rival firm, said North Korea-linked groups have stolen $7.4 billion in 2026 alone.
The comparison Binance would rather avoid is FTX. When that exchange collapsed in December 2022, customers pulled about $6 billion in 72 hours, and the run exposed a balance sheet that did not hold what it claimed. Binance’s case differs in one respect: the assets were taken by an outside party rather than misspent by insiders, and the company says it is solvent. It is similar in another: withdrawals are the only test customers can run, and they run it when they are frightened.
Binance’s history makes that test harder. The company paid $4.3 billion in 2023 to settle U.S. criminal and civil cases over money laundering and sanctions violations, and its founder, Changpeng Zhao, stepped down and later served a prison sentence. Richard Teng, who took over as chief executive, has spent his tenure arguing that the company is more compliant than its reputation. A multibillion-dollar theft executed through an employee’s laptop does not strengthen that case.
The event also lands in a year in which North Korean crypto revenue has become a matter of state finance. The regime uses stolen digital assets to fund programs that sanctions are meant to block, and it has become practiced at laundering them through decentralized exchanges, mixers and chains that are cheap to use. The FBI’s request that addresses be blocked is the standard response. Its effectiveness depends on how quickly the stolen ether moves and how many venues comply.
Some of it has been caught. World Liberty Financial, a crypto company with ties to the Trump family, said it worked with the custodian BitGo to freeze funds linked to the hack. Binance.US, a separate entity, said it was unaffected. President Trump, asked about the case, said, “We don’t know if it’s North Korea,” while allowing that it might be.
For the industry, the first question is whether other exchanges see withdrawals. Coinbase, Kraken and the largest offshore venues publish less detailed figures, and a flight toward whatever customers perceive as safer custody would redistribute balances without changing the total. The second is whether self-custody accelerates. An event that empties a hot wallet in minutes is the best advertisement a hardware wallet has ever had.
The third is what an exchange can promise. Binance’s pledge to make customers whole rests on its own balance sheet and on its ability to recover frozen assets, and neither has been audited in public. The company has published reserve reports in the past, assembled by a third party from wallet addresses it controls. Those reports show assets against liabilities at a moment in time; they do not show whether the operator can survive a week in which a third of its customers want out.
Regulators will ask the same question from the outside. Binance operates under settlements with the Justice Department and with the Treasury’s financial crimes unit, which installed monitors as a condition. A breach of this size, on a platform that was already under supervision, invites scrutiny of what those monitors were watching and what they were told. The company has not said whether it disclosed the laptop compromise to them before the theft, or only afterward.
Binance says the withdrawals are slowing. Reuters reported on Monday that the outflow was stabilizing as the exchange returned to normal operation. That is what the company would say, and it may be accurate. The number that settles it will be the one published at the end of the week, after the customers who wanted out have gone and the rest have decided whether a compensation promise is worth more than the exit.
