Binance, the world’s largest cryptocurrency exchange, says customer withdrawals have returned to normal levels following a major cyber theft last week that triggered billions of dollars in outflows.
The exchange, which had recorded net withdrawals of $4.72 billion by Monday, has also launched a campaign offering incentives to retain existing customers and attract new users.
Speaking at Hong Kong Fintech Week on Tuesday, Binance Chief Executive Richard Teng said withdrawals surged during the first 24 hours after the incident, as expected, but subsequently stabilised.
He described the company’s financial position as strong and said 95 per cent of the affected tokens had been replenished.
Teng added that Binance had sufficient resources to cover the losses.
In a statement posted on social media earlier Tuesday, the exchange said deposits were exceeding withdrawals on an hourly basis, indicating improving user activity and stabilising fund flows.
The Federal Bureau of Investigation (FBI) said over the weekend that North Korea was responsible for stealing more than $6 billion in cryptocurrency assets, in what has sent shockwaves through the digital-asset industry.
Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, rejected the US allegations, describing them as evidence of Washington’s continued hostility towards Pyongyang.
In remarks carried by North Korea’s state media on Tuesday, Kim said the allegations were an attempt to portray the country as a cybercriminal state. She dismissed the claims as baseless and politically provocative.
She also criticised the United States for suggesting that cyberattacks around the world were linked to organisations supported by North Korea.
Kim said Pyongyang had issues to reconsider in response to what she described as Washington’s hostile approach, but did not provide further details.
North Korea has yet to respond publicly to US President Donald Trump’s earlier offers to resume summit-level diplomacy.
North Korea has faced increasing scrutiny over cryptocurrency theft, which analysts believe has become an important source of funding for its weapons programmes.
Cybersecurity experts say North Korean hacking groups are among the world’s most active cryptocurrency thieves, with stolen funds allegedly helping finance the country’s nuclear and ballistic missile development efforts.
Blockchain analytics firm Elliptic estimates that North Korea has stolen $7.6 billion worth of cryptocurrency this year, marking its highest annual total on record. Pyongyang has repeatedly denied involvement in cryptocurrency theft and other cybercrimes.
Analysts in Seoul said North Korea’s swift response to the US allegations could reflect concerns that the claims may lead to stronger international efforts to disrupt financial channels allegedly used to support its weapons programmes.
Lim Eul-chul, a professor at Kyungnam University’s Institute for Far Eastern Studies, said cryptocurrency theft had become one of North Korea’s key sources of funding amid existing international sanctions.
He warned that additional US measures targeting cryptocurrency wallets, money-laundering networks and exchanges could disrupt an important revenue stream for Pyongyang.
South Korea’s central bank estimated North Korea’s gross domestic product at 47.18 trillion won, or approximately $35.09 billion, in 2025. The reported Binance theft could therefore be equivalent to around one-sixth of the country’s economic output.
Blockchain analytics firm Chainalysis estimated that North Korea was linked to 89 per cent of cryptocurrency hacking losses in 2026, compared with 15 per cent in 2021.
The firm also reported that the average loss per hacking incident increased from $50.65 million in 2021 to $185.65 million in 2026.
Alec Zebrick, senior manager of Asia-Pacific Global Services at Chainalysis, described the trend as a form of large-scale targeting in which hackers focus on major exchanges because successful attacks can generate substantial returns despite requiring greater time and technical complexity.
North Korea, one of the world’s poorest countries, has continued to invest heavily in its nuclear and missile programmes, despite international sanctions and restrictions imposed under United Nations Security Council resolutions.
Binance launched a promotional campaign on Monday offering trading-fee rebates and rewards to eligible users who achieve at least $10,000 in cumulative trading volume. The campaign also includes annual percentage rates of up to 10 per cent on selected yield-generating products.
The exchange’s community appreciation campaign is scheduled to continue until November 21, according to details published on its website.
Binance had suspended withdrawals for more than two days following the cyber incident before gradually restoring access to certain assets on Sunday morning. Withdrawals for additional assets were reopened on Tuesday.
The exchange said on Monday that net outflows since withdrawals resumed amounted to approximately 3 per cent of the assets held on its platform. Analysts described the figure as relatively modest, suggesting that customer confidence had largely remained intact.
Maksym Repa, head of decentralised finance (DeFi) at Bitcoin finance protocol Lombard, said the limited market reaction reflected growing resilience in the cryptocurrency sector.
He added that investors appeared to be distinguishing between a security breach at a centralised exchange and a wider technical problem affecting the Bitcoin network.
