Binance Net Outflow Reaches $4.7 Billion Since Reopening as North Korea Denies FBI Attribution for $6.3 Billion Hack

Since Binance began a phased reopening of withdrawals on Sunday, Nov. 1, after the $6.3 billion theft of Oct. 29, the outflow has grown beyond the first-day figure, and Pyongyang has now rejected the FBI's attribution.

The outflow has widened

A Binance spokesperson said Monday that customers withdrew $7.42 billion and deposited $2.7 billion once transactions resumed. That is a net outflow of about $4.7 billion.

The first-day figure, published by Binance, was a net $3.64 billion: $4.649 billion out and $1.01 billion in, measured between 06:00 and 15:30 UTC on Nov. 1. The net outflow is now larger than that first-day figure.

The percentages also moved. Binance's first-day update put the outflow at 2.1% of $171 billion in assets. The spokesperson now describes the $4.7 billion as about 3% of $157 billion in total assets.

Binance, the world's largest cryptocurrency exchange with more than 300 million users according to CBS News, calls the outflow manageable. "The net outflow is a relatively limited portion of Binance's overall asset base," the spokesperson said in an email. "Withdrawal levels are stabilizing to what we would consider normal and expected on-chain activity."

Co-CEO Richard Teng said the same at a Hong Kong FinTech Week event. "In the first 24 hours, there was a spike in terms of withdrawals, as can be expected. But after that ... it's pretty much normalized," he said. He added that the company is "in very strong financial health."

In a post on X, Binance said hourly deposits were exceeding withdrawals, "reflecting improving user activity and stabilizing flows."

North Korea rejects the FBI's finding

The FBI said Saturday that TraderTraitor, a hacking group linked to North Korea, was responsible. Kim Yo Jong, an influential official in North Korea's ruling Workers' Party, responded Tuesday, Nov. 3, in a statement carried by the state news agency KCNA.

She called the FBI announcement "a trite provocation" and "absurd rhetoric and nothing new." She said it is "a grave political provocation against the DPRK that the U.S. misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds."

The FBI's position is on the record. It named TraderTraitor as responsible for the Binance theft and for the February 2025 attack on the Bybit exchange, which cost $1.5 billion. It said the group was converting stolen assets into ethereum and expected them to be laundered further through decentralized finance and instant-swap services.

The FBI, the Secret Service and the IRS criminal investigation service are urging THORNode operators, RPC node operators, instant exchanges and DeFi services to block transactions derived from the Ethereum addresses TraderTraitor is using. The addresses are listed on the FBI's website.

Blockchain analytics firm Elliptic says North Korea has stolen $7.6 billion in crypto in 2026, more than in any previous year. Lim Eul-chul, a professor at Kyungnam University in South Korea, said theft has become "one of North Korea's key channels for securing funds for regime maintenance and weapons development" under sanctions. South Korea's central bank put North Korea's 2025 GDP at 47.18 trillion won, about $35.09 billion.

Reimbursement and recovery

Binance says it has frozen roughly $3 billion of the stolen assets. Teng said 95% of the affected tokens had been replenished, and the company said the remainder involves less liquid tokens that take longer to buy at scale. Teng has said users will not bear the loss.

The money behind that pledge is Binance's corporate treasury, the security fund it set up in 2018, and part of its futures insurance fund.

Alexander Shirtcliff, head of commercial disputes and class actions at the law firm Edwin Coe, said customers should not treat the pledge as legally binding. "Taking the current standard user terms at face value, they contain limits to Binance's liability to customers and I see no commitment on using the Secure Asset Fund," he said. He added that questions over how Binance distributes the money, to whom and when, "will create a constellation of additional legal issues."

The stolen funds are still moving. Alec Zebrick, a senior manager at Chainalysis, which is working with Binance and government agencies, said: "We continue to see funds being laundered quite actively."

How the breach happened

Binance's early disclosure said the attack may have involved a compromised DevOps engineer's laptop, which gave the attacker access to a service container and let them submit unauthorized withdrawal transactions. The company said it found no evidence of a wallet private key leak.

Binance has since said it found further "points of breach" beyond the laptop. Teng said the company is rebuilding and retesting its "entire infrastructure system" and conducting a full security review.

Binance has committed to publishing a detailed technical post-mortem once the investigation is complete. It has also promised an updated proof of reserves once remediation is complete. The company has said the remaining tokens are taking longer to buy, but has not given a date for completing that.