Binance customers withdrew a net $3.64bn (£2.72bn) when the exchange reopened on Sunday, a little over 2% of the $171bn of assets it says it manages. The figure is large in absolute terms, yet it is a modest share of the platform's holdings, and the company describes the outflow as stabilising. That is a reasonable sign of resilience. It is not, on its own, proof that the underlying problem has been solved.
The breach was serious. The firm suspended all transactions after an incident that affected $6.3bn of digital assets, and the US Federal Bureau of Investigation has accused North Korea of responsibility. Binance says it has covered around 95% of the stolen assets and that the remainder may take longer to source. It has also said it reserved more than $6.34bn to deal with the fallout, drawing on its corporate treasury and futures insurance and emergency reserve funds. Those commitments matter, and they should be held to account in the weeks ahead.
The most telling detail is the reported cause. Binance said early checks suggest the incident may have started with a compromised laptop belonging to an engineer, which allowed hackers to make unauthorised transactions. That is a human and procedural failure as much as a technical one. A trading platform holding this much money should not be exposed by a single device, and users are entitled to know what has changed in access controls, monitoring and engineer equipment since the attack.
The phased restoration is sensible, but customers should be cautious about declarations of normality. Withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, and other services will return only once security checks are complete. Regulators and the wider industry should insist that each stage is verified openly rather than announced on social media. Binance's promise to cover all of the losses is only as credible as the accounts that back it.
What should happen next is clear. Binance should publish a detailed post-incident review, confirm how the remaining 5% of stolen assets will be recovered and by when, and show independent verification of its reserves. Industry partners should continue blocking transactions linked to the wallet addresses the FBI published. Exchanges can recover from a record hack, but only if they treat recovery as a demonstration of accountability rather than a race to reopen.