Binance customers pulled $3.64 billion, or 2.1% of its assets, as the world's biggest cryptocurrency exchange went back online on Sunday after hackers the FBI links to North ​Korea stole billions from the platform last week. Binance said withdrawals were stabilising after an initial spike and deposit volumes had remained "substantial". The exchange said it had now covered 95% ‌of the $6.3 billion of stolen assets. The heist, which analysts believe may be the biggest financial robbery ever, adds to a string of recent crypto thefts. Withdrawal levels are an early test of whether customers still trust the exchange with their money after the attack. Attackers stole $2.9 billion worth of cryptocurrency across nearly 150 incidents last year, according to researchers at TRM Labs. Read: FBI and US Secret Service working with Binance after $6.3 billion hack, source says Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026. By 12:36 UTC, withdrawals had resumed for all 15 networks and assets in the initial phase. After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit… pic.twitter.com/ZSnYGCTp9d — Binance (@binance) November 1, 2026 Binance said the net outflows reflected what clients had withdrawn and deposited as of 1530 GMT. Crypto analytics platform DefiLlama said on its dashboard that ​outflows were higher, at $4.36 billion. "This figure does not contain the flows we have deposited to our own new hot wallet, so they are not accurate. Our last update on X is closest ​to accurate (outstanding the moves in both deposits and withdrawals since it was posted)," a spokesperson for Binance said of the DefiLlama data. Binance, which was founded in China, ⁠said the rollout for withdrawals would be carried out in phases, prioritising user demand. The first phase covered 15 tokens, including bitcoin, ether and those involving some USDC and USDT stablecoins and dogecoin. "We are taking ​a phased approach by prioritising tokens based on the past week's data of user demand," Binance said in an earlier article posted on X. Binance said earlier on Sunday that it had covered $6 billion of stolen cryptocurrencies by using ​company money to buy replacement tokens. The remaining 5% of stolen tokens consist of less liquid assets and may take longer to source in the required amounts, it said. Update: We had already covered $6B of the impacted amount of the hacked loss. — Binance (@binance) November 1, 2026 FBI ties attack to North Korean unit The FBI said on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack. The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n — FBI Cyber Branch (@FBICyberBranch) October 31, 2026 Pyongyang has for years denied using state-linked cyber units for espionage, financial theft and revenue generation. Its mission in Geneva and embassy in China did not respond to requests for comment. Law ​enforcement observed members of the unit converting stolen assets into the cryptocurrency ether, the FBI said in a statement, adding that it expected "further laundering" of the assets through the use of related technology. Analysts had also pointed ​to North Korea's involvement. The bulk of the theft unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis. US President Donald Trump, ‌however, later on ⁠Saturday said it remained unclear whether North Korea was involved. "We don't know if it's North Korea — but if it is, we'll talk to North Korea about it," Trump told reporters in comments posted by a White House account on X. .@POTUS on the Binance hack: "We're learning about it. We don't know if it's North Korea — but if it is, we'll talk to North Korea about it." pic.twitter.com/TgiQ8Amwei — Rapid Response 47 (@RapidResponse47) November 1, 2026 Binance vows to bear financial costs Binance has been working with other crypto firms to freeze some of the affected assets, with about $3 billion located as of Friday, it said. Read More: Binance freezes assets after $6.3 billion heist, crypto industry's biggest The exchange has repeatedly said it will bear the financial impact of the hack and has set aside around $6.34 billion of company funds to cover the losses. Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU — Binance (@binance) October 30, 2026 The money spent buying replacement tokens came from Binance's $1 billion Secure Asset Fund for Users (SAFU), a bitcoin ​reserve it holds to protect customers in the event ​of security breaches, as well as some of ⁠its Futures Insurance Fund and its corporate treasury, it said on X. Co-CEO Yi He said on Saturday that Binance would use 50% of its SAFU funds, while the company committed to replenishing the fund to about $1 billion. Richard Teng, the other co-CEO, has said that the breach was a "complex attack" involving a compromised laptop and malicious ​software designed to delete evidence of its activity, making it harder to trace and investigate. Crypto prices fell on Friday, while Binance sought to reassure customers ​that their funds were safe. Binance, which ⁠allows users to buy, sell and trade digital assets, has 335 million registered users globally. It said on Sunday it had $171 billion in total assets under management as of October 28. Binance founder thanks US law enforcement In a post on X that quoted the FBI statement on North Korea’s involvement, Binance founder Changpeng Zhao thanked the agency for its support. Binance did not respond to a request for comment on North Korea's involvement. US Law Enforcement agencies (FBI, USSS, IRS and more) provided vital help in this incident, including tracking, freezing, etc. A tweet can’t fully express our gratitude. Many crypto bros may not realize, a lot of the "why bitcoin didn't drop more?" credit goes to them. 🙏 https://t.co/5dpQKGNQI7 — CZ 🔶 BNB (@cz_binance) November 1, 2026 Zhao, who was convicted in the United ⁠States of failing ​to maintain an effective anti-money laundering program before being pardoned by Trump last year, said US law enforcement agencies provided vital ​help, including helping to track and freeze stolen assets. "A tweet can't fully express our gratitude. Many crypto bros may not realise, a lot of the 'why bitcoin didn't drop more?' credit goes to them," Zhao wrote, referring to US law enforcement agencies.