Binance reports customers withdrawing $4.7 billion after North Korea hack

Image: The Epoch Times

business

Summary

Binance reopened withdrawals on Sunday, Nov. 1 after a hack that stole about $6.3 billion in digital assets. In the first hours, customers withdrew a net $3.64 billion, while the exchange said it had replaced roughly 95% of the stolen funds using its own reserves. The FBI attributed the theft to a North Korean state‑sponsored group, and President Trump said the United States does not yet know if North Korea was responsible.

Why It Matters

The incident tests Binance’s ability to protect user assets and maintain confidence in the crypto market, while the FBI’s attribution raises geopolitical concerns about North Korean cyber‑crime. Ongoing withdrawals and the remaining 5% of unreplaced tokens will shape regulatory scrutiny and future security measures.

◀ Left's Take

Left-leaning outlets more often stressed Binance's past money-laundering guilty plea, Zhao's pardon by Trump and the Trump family's crypto ties. On Bluesky, widely shared posts criticized the industry and headlines suggesting the stolen funds had been recovered.

Right's Take ▶

Right-leaning outlets such as Fox News and the New York Post focused on the FBI's attribution to North Korea, the scale of the theft and Trump's remark that it was not yet known whether North Korea was behind it.

RUSH Facts

• Approximately $6.3 billion in crypto assets were reported stolen in the Binance hack (Al Jazeera)

• Binance halted withdrawals and began restoring them on Sunday for major cryptocurrencies (CBS News)

• Customers withdrew $4.6 billion (CBS) to $4.7 billion (NY Post) after withdrawals resumed

• Net outflow after deposits was $3.64 billion (TASS)

• Binance replaced 95 percent of impacted assets using company funds (Al Jazeera)

• Over $6 billion, including half of its $1 billion SAFU fund, was set aside to cover losses (The Epoch Times)

• About $3 billion of stolen assets were frozen; the rest is being laundered (FBI)

• Binance’s post‑incident balance sheet showed total assets of $157 billion to $171 billion (NY Post, CBS)

L 0%

C 25%

R 75%

www.rushnewstream.com

RUSH

RUSH ORIGINALIN FOCUS

Binance Customers Pull $3.6 Billion as Withdrawals Resume After $6.3 Billion Hack

The exchange says it has replaced about 95% of the stolen assets with its own funds and users won't bear the loss. The FBI blames North Korea; President Trump said, "We don't know if it's North Korea."

By RUSH Newstream Nov 2, 2026, 6:36 PM ET

Written by RUSH's AI reporter.

Binance, the world's largest cryptocurrency exchange, reopened withdrawals on Sunday, Nov. 1, three days after hackers stole about $6.3 billion in digital assets in what is believed to be the largest theft in crypto history. Customers pulled a net $3.64 billion in the first hours, about 2.1% of the exchange's $171 billion in total assets, according to CNBC, citing Binance's figures and its latest proof-of-reserves data.

Binance said it processed $4.65 billion in withdrawals and $1.01 billion in deposits between 6 a.m. and 3:30 p.m. UTC, and that after an "initial spike," withdrawals "are stabilising as expected," according to the BBC. Crypto analytics platform DefiLlama put outflows higher, at $4.36 billion; a Binance spokesperson said that figure did not count deposits into the exchange's new hot wallet, according to the New York Post. Founder Changpeng Zhao wrote on X that "98% choose to stay!" according to CNBC.

Covering the losses

Binance has said customers will not bear the loss. The company said it had covered about 95% of the stolen amount, up from 90% on Saturday, using its roughly $1 billion bitcoin reserve fund for users, its corporate treasury and its futures insurance fund, according to CNN. The remaining 5% consists of less liquid tokens that will take longer to buy, Binance said. "Binance will absorb the financial impact of the stolen funds, not our users," co-CEO Richard Teng posted on X.

Withdrawals are returning in phases, starting with 15 networks and assets including bitcoin and ether, prioritized by user demand, and Binance warned of possible delays, according to CNN and Al Jazeera.

Who did it

The FBI said Saturday that North Korea was responsible, attributing the theft to a state-sponsored group it tracks as TraderTraitor, the same actors behind the $1.5 billion Bybit hack in 2025, according to The Guardian and The Epoch Times. The FBI said it had seen the hackers converting stolen assets mainly into ether, expected further laundering, and urged crypto firms to block transactions linked to a list of addresses. Binance has said the breach may have started with an engineer's compromised laptop and later reported "additional points of breach," according to Al Jazeera and the New York Post.

President Donald Trump, asked about the hack Saturday night, said, "I'm not concerned. We're learning about it. We don't know if it's North Korea, but if it is, we'll talk to them about it," according to Fox News.

How outlets covered it

Most outlets reported the same core facts. Left-leaning outlets more often added context on Binance's history and Trump's ties to the industry. Many, including NPR and The Guardian, noted that Zhao pleaded guilty in 2023 to a felony related to failing to prevent money laundering and was pardoned by Trump in 2025. Futurism wrote that the pardon came "after Binance provided support to World Liberty Financial, the Trump family’s much-scrutinized crypto venture," and CBS News reported that World Liberty Financial was among the firms that froze stolen assets. NBC News noted that Trump has disclosed earning more than $1 billion from crypto last year. Right-leaning outlets such as The Epoch Times and Breitbart also mentioned the pardon, but less prominently.

Right-leaning outlets gave more space to Trump's remarks questioning North Korea's role, which Fox News and the New York Post reported and most left-leaning outlets in the sources did not. An earlier New York Post report said the compromised laptop indicated "a potential inside job or a stunning AI-powered infiltration," based on comments from a security executive who said he would not rule out an inside job but believed AI was most likely involved. No investigator in the sources has suggested an inside job.

Coverage of how much Binance had covered varied with timing: Saturday reports said 90%, Sunday reports 95%. CBS News wrote that Binance "would cover 90% of the losses," though Binance had pledged to cover all of them.

On social media

On Bluesky, the most-shared posts were critical of the industry and of the coverage. @molly.wiki, an account that writes about crypto, in a post with nearly 3,000 likes objected to headlines saying Binance had "recovered" the stolen funds: "Binance hasn’t REcovered $6B+, it’s COVERING it (reimbursing customers from company funds)." A Reuters headline carried by US News said Binance was "Recovering Bulk" of the funds; most other outlets described the money as replaced or covered. Other widely shared posts, such as one from @charlieangus104.bsky.social, tied Binance to Trump family business interests, an angle outlets addressed through the pardon and World Liberty Financial.

On X, discussion came mostly from crypto-market accounts tracking outflows and prices, and Trump's comment that he would talk to North Korea circulated in roundups such as @CryptoTweets. No significant angle from the right or the left that outlets aren't covering was spreading there.