Binance’s phased return to normal operations has become a test of whether assurances of full customer protection can contain the fallout from a $6.3bn theft.

Customers withdrew $4.6bn after the exchange began reopening services, against $1bn in deposits, leaving a net outflow of roughly $3.6bn — 2.1% of Binance’s reported $171bn in assets under management.¹ The withdrawals followed an initial suspension of transactions after what was described as the largest crypto hack on record.

Binance has stressed that the pressure eased after the first rush. It said withdrawal volumes had “declined and are stabilising as expected”, while deposits remained substantial.¹ The exchange restored withdrawals in stages for selected networks and assets, including Ethereum-based USDT and USDC, and said further services would return after security checks.

Its central message is that users will not bear the loss. Binance said it had replenished most of the stolen assets and set aside about $6.34bn from its secure asset fund, insurance resources and corporate treasury. Co-chief executive Richard Teng said the company was “committed to covering the remaining 10%”.¹ A separate account put the proportion already covered at around 95%, while noting that less liquid tokens could take longer to source.²

The official investigation gives the incident a broader security dimension. The FBI said North Korea was responsible for the theft and identified actors associated with TraderTraitor, a group linked by investigators to the Lazarus Group. It said it had observed them converting stolen holdings into ethereum and urged private-sector entities to block related laundering transactions.¹

The contrast is clear: Binance portrays a managed restoration backed by reserves, while the scale of the outflows and the alleged state-linked attack underline the continuing challenge of restoring trust after a breach of this size.