Investors have pulled more than $3bn (£2.2bn) from the world's largest cryptocurrency exchange in the wake of a devastating cyber attack by North Korea .
Binance reopened customer withdrawals at about 6am on Sunday, three days after freezing them following the theft of $6.3bn from the digital currency exchange.
Richard Teng, Binance's chief executive, said the group had begun a "phased resumption of withdrawals". By midday, customers had pulled around $3.7bn, according to data from analysis firm DefiLlama.
The rush to withdraw is unlikely to threaten the company, which has total assets of more than $150bn, according to data from Coinmarketcap.
However, it highlights the febrile atmosphere in the cryptocurrency market following the historic hack, which was the biggest heist of any kind in history.
Bitcoin has fallen nearly 4pc since the attack on Thursday. Changpeng Zhao, Binance's founder, suggested it would have fallen more were it not for the FBI and other US law enforcement agencies.
"Many crypto bros may not realise, a lot of the 'why Bitcoin didn't drop more?' credit goes to them," he wrote on X.
US officials formally blamed the cyber attack on Pyongyang on Saturday. The FBI said that a hacking group known as TraderTraitor, which analysts have tied to the North Korean regime, was behind the attack.
While most of the country's citizens have no access to the internet, North Korea operates a rigorous state hacking programme, hand-picking prize-winning maths students for its cyber army.
The hermit kingdom's elite hackers have stolen an estimated $12.8bn in cryptocurrency over the last decade, with analysts at TRM Labs saying $7.4bn of that total has come in 2026 alone. North Korean hackers have been blamed for around 85pc of all cryptocurrency theft so far in 2026.
Kim Jong-un, North Korea's supreme leader , has described the nation's hackers as "warriors" supporting a "strong and prosperous nation". Pyongyang uses the stolen funds to invest in its illicit weapons programmes and prop up its struggling economy.
TraderTraitor is part of a wider unit known as Lazarus Group, which hacked film studio Sony in 2014 as revenge for a film mocking North Korea's ruler. In total, the nation's cyber army consists of an estimated 7,000 hackers and other officials.
Thursday's record-breaking hack saw $6.3bn stolen from Binance's digital wallets in just 20 minutes and rapidly laundered through a series of complex transactions.
Asked about the cyber attack on Saturday night before the FBI statement, Donald Trump said he would "talk to" North Korea if it was found to have planned the hack.
"We're learning about it. We don't know if it's North Korea," he said. "But if it is, we'll talk to North Korea about it."
The raid on Binance ranks as the biggest heist in history, ahead of an earlier $1.5bn hack of cryptocurrency company Bybit. It also eclipses the largest physical theft in history, when Saddam Hussein's family stole $1bn from the Bank of Iraq in 2003.
Hackers reportedly infiltrated a Binance engineer's laptop before using that breach to gain wider access to the company's systems and digital wallets.
From there, billions in funds were moved between different cryptocurrencies and lending services in an attempt to make them impossible to recover.
Other cryptocurrency giants, such as Tether and Circle, froze around $3bn in funds that were initially stolen from Binance, however billions more were rendered effectively inaccessible by the hackers.
A source close to Binance said Sunday's outflows were within the boundaries of "normal and expected" trading activity. The exchange's net outflows were broadly flat by 3pm on Sunday.
The company has covered around 95pc of the stolen funds from its own reserves and an insurance fund.
Mr Teng said: "Binance will absorb the stolen funds, not our users."
Cyber security experts were already on high alert after AI was used to uncover a critical vulnerability in about 70pc of the web last month. Analysts have warned that AI threatens to unleash a new wave of supercharged hacks that the world is not ready to counter.
A Binance spokesman said: "Restoring access to user funds is a priority and we are taking a controlled approach to do so safely. We will continue to monitor closely as services return in phases.
"User funds remain safe and deposit services remain open and are not affected by the incident."
