Reporting snapshot · 2 November 2026. The outflow figures are provisional tallies for one afternoon rather than an audited balance sheet, and Binance's full proof-of-reserves report is due on 2 November. Pyongyang denies involvement in the theft, and the final cost can still change as more tokens are recovered or written off.
What happened
Binance reopened customer withdrawals in phases from 06:00 UTC on Sunday, 1 November, ending a suspension imposed after about $6.3bn was taken from its wallets on 29 October, as KhabarWire reported. By Sunday afternoon the exchange had processed about $4.6bn of withdrawals against about $1bn of deposits, leaving a net outflow of roughly $3.6bn, The Guardian reported.
Reuters put the net figure at $3.64bn, equal to 2.1 per cent of the $171bn in assets Binance held under management on 28 October, citing the company’s own tally. The first phase covered 15 networks and assets, including bitcoin, ether, USDT and USDC, and some tokens on BNB Smart Chain; Dogecoin and Avalanche withdrawals resumed later on Sunday, the Guardian reported. Binance said it was restoring access in stages, starting with the tokens customers had demanded most in the previous week, France 24 reported.
The exchange also said it had covered 95 per cent of the stolen assets by buying replacement tokens with company money. It had earlier reported 90 per cent, and said the remaining 5 per cent were less liquid tokens that could take longer to source, Reuters reported. Binance set aside about $6.34bn of its own funds and said customers would not bear the loss, France 24 reported.
A Binance spokesperson disputed a higher estimate from the crypto analytics platform DefiLlama, which showed $4.36bn of net outflows. The spokesperson said the dashboard did not include deposits Binance had made to its new hot wallet, making its figure inaccurate, Reuters reported. Binance said withdrawals had stabilised after an initial spike and that deposit volumes remained “substantial”, the Guardian reported.
Why the run matters
In proportion, 2.1 per cent is a modest withdrawal for an exchange of Binance’s size. In direction, it is the first public measure of whether customers were willing to leave their money on the platform after the largest crypto theft on record.
The run is also a reminder that a crypto exchange is not a bank: customer balances are liabilities of the exchange, not deposits protected by a government insurance scheme, and a proof-of-reserves snapshot is not an audited balance sheet. Binance has said company funds and its Secure Asset Fund for Users will cover the loss; its full report, due on Monday, will be the first detailed test of that claim.
The available figures cover Binance alone; they do not show whether customers moved the money to other exchanges or out of crypto entirely. The immediate market reaction to the theft was sharp: bitcoin fell nearly 5 per cent, ether nearly 6 per cent and BNB, the token tied to Binance, nearly 10 per cent after the breach was disclosed, the Guardian reported. The more important test may be whether customers who withdrew on Sunday bring the money back once withdrawal queues clear.
Binance’s scale makes the episode matter beyond its users. The exchange says it has 335 million registered users and held $171bn in assets on 28 October, Reuters reported; a disorderly run at an institution that size would trouble the wider crypto market even if Binance remained solvent.
The FBI’s North Korea finding
On Saturday, 31 October, the FBI said North Korea was responsible for the theft, naming a North Korean unit known as TraderTraitor. The agency said it had observed TraderTraitor actors converting stolen assets into ether and expected further laundering through decentralised finance and instant swap services, and it urged private-sector firms to block transactions tied to addresses the unit was using, The Guardian reported.
TraderTraitor is believed to be part of the Lazarus Group, the North Korean operation blamed for the 2014 hack of Sony Pictures, the Guardian reported. The attribution is a law-enforcement assessment, not a court finding, and it does not by itself establish who will recover the assets or how much will be returned.
President Donald Trump publicly questioned the finding. “We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it,” he told reporters, according to Reuters. France 24 reported that he also said he was “not concerned”. Pyongyang has for years denied using state-linked cyber units for financial theft, and its diplomatic missions did not respond to requests for comment, Reuters reported.
The competing signals matter: a confirmed state attribution can justify sanctions, asset freezes and coordination among exchanges, while uncertainty can slow those steps. Binance founder Changpeng Zhao thanked the FBI and other US agencies for help tracking and freezing funds, Reuters reported.
What it means for Pakistan
Binance and HTX hold no objection certificates from the Pakistan Virtual Assets Regulatory Authority (PVARA), the federal regulator created under the Virtual Assets Act, 2026. The authority’s news feed records that it granted NOCs to Binance and HTX in December 2025, under its new rules.
An NOC is preliminary approval, not a full licence. PVARA’s licensing framework says every virtual-asset service provider must obtain a formal licence before offering services in Pakistan, and it lists customer-fund safeguards, cybersecurity, anti-money-laundering checks and business-continuity plans among the requirements, according to the authority.
PVARA’s public news feed had no statement on the breach or the withdrawal run as of 2 November; its most recent Binance-related entry was the December 2025 NOC announcement. The authority has not said publicly whether it is reviewing the incident, whether the NOC requires breach reporting, or how many Pakistani users hold balances on Binance.
Pakistan’s crypto market is newly regulated. The Senate passed the Virtual Assets Act in February, as KhabarWire reported, and the State Bank of Pakistan then set rules for virtual assets and crypto-linked bank accounts in April, covered here. The number of Binance users in Pakistan and the share of the $3.6bn that belonged to them are not public, so the local effect of the run cannot yet be measured.
For customers, the practical questions are whether withdrawals are processing, whether balances are whole and whether the exchange’s regulatory position changes. Binance says it will cover the losses and has restored the main networks; PVARA has not said whether it will impose conditions.
What is still uncertain
The first uncertainty is the flows. The $3.6bn figure covers one afternoon and mixes withdrawals with deposits; DefiLlama’s higher number shows how much depends on which wallets are counted. A full picture will emerge after all networks reopen and Binance publishes its reserve report.
The second is the final cost of the theft. Binance says it has covered 95 per cent of the stolen assets, but it has not shown how much of that was bought with company money, how much was frozen by issuers and law enforcement, and how much remains unrecovered. The remaining 5 per cent is the least liquid and the hardest to replace. The $6.3bn headline is also an estimate that depends on asset prices at the time of the theft.
The third is attribution. The FBI’s statement is an official finding, but Trump’s doubt and Pyongyang’s denial mean the question is not closed. Nor is it clear whether the stolen assets will be laundered through the same channels the FBI has warned about, or how much can be clawed back.
For Pakistan, the most visible open question is regulatory at this stage. PVARA has not said whether it will review Binance’s compliance with its NOC conditions, whether it will require additional disclosures from the exchange, or whether the incident changes its licensing timetable. Until it does, Pakistani users have no local public assessment of what the breach means for them beyond Binance’s own statements.
What is clear is the sequence: a $6.3bn theft, a two-day withdrawal freeze, a phased reopening on 1 November, and a net outflow of about $3.6bn in the first afternoon. Whether that was a one-off rebalancing or the start of a longer retreat will be visible in the next few days of flows, and in the reserve report Binance has promised.
