Binance customers withdrew $3.64bn (£2.72bn) from the world's largest cryptocurrency exchange when it reopened on Sunday, a week after what the report describes as the largest hack in history. The figure is striking, but the more important question is what it reveals about trust. Users who pulled out billions were not being irrational. They were responding to a breach that affected $6.3bn in digital assets and to a company that had suspended all transactions in its wake.
Binance says it has covered around 95% of the stolen assets and has reserved more than $6.34bn to deal with the fallout. It has also repeated that it will fully cover the financial impact of the stolen funds. Those are welcome commitments, and the firm deserves credit for moving quickly to restore withdrawals for more than two dozen major cryptocurrencies, including Bitcoin and Ethereum. Still, a promise to make customers whole is only as good as the resources and transparency behind it. Customers should be able to check how the reserves are being used, not simply take the company's word for it.
The attack has been attributed by the US Federal Bureau of Investigation and others to TraderTraitor, also known as the Lazarus Group, a North Korean cybercrime group. The report also notes that the group stole $1.5bn from Bybit in 2025. If a single engineer's compromised laptop was the entry point, as Binance's early checks suggest, then the lesson is not only about one employee. It is about how much a single device can expose when it sits close to systems that move billions of dollars.
Regulators and the industry should press for clearer standards on internal security, including how access to transaction systems is controlled and how quickly suspicious activity is detected and reported. The FBI's decision to publish wallet addresses and urge partners to block related transactions shows that coordination can work. That cooperation should be routine, not a response reserved for record-breaking disasters.
Binance has reopened and the outflows are, in its words, stabilising. That is a relief for its hundreds of millions of registered users. But recovery is not the same as reform. The exchange should publish a detailed account of the breach, explain exactly how the remaining 5% of stolen assets will be sourced, and commit to independent verification of its security changes. Confidence will return only when customers can see the evidence themselves.