Binance said customer withdrawals were stabilising after the world’s largest cryptocurrency exchange returned online following a security breach in which $6.3 billion worth of assets were stolen last week. Customers withdrew $3.64 billion, equivalent to 2.1% of the exchange’s assets, while Binance said deposits remained substantial.

The company said it had covered 95% of the stolen assets. The remaining 5% consists mainly of less liquid tokens that could take longer to obtain in the required quantities. Binance also said it would bear the financial impact of the incident and had allocated about $6.34 billion in company funds to cover the losses.

Ari Redbord, global head of policy at TRM Labs, described the withdrawals as a precautionary response rather than a broader flight of capital. Binance reported $171 billion in assets under management as of October 28 and has 335 million registered users worldwide.

The exchange is processing withdrawals in stages, prioritising tokens according to recent customer demand. The first phase included 15 tokens, among them Bitcoin, Ether, dogecoin and assets involving the USDC and USDT stablecoins. Binance said market conditions were stable.

Different figures have emerged regarding the scale of the outflows. Crypto analytics platform DefiLlama listed outflows of $5.81 billion, up from $4.36 billion previously. Binance said that figure did not account for funds deposited into a new company hot wallet and therefore did not accurately reflect the situation. The company said its own net-outflow figure included both withdrawals and deposits after the incident.

The breach also affected cryptocurrency markets. Bitcoin, which fell to a six-week low on Friday, recovered slightly over the weekend to trade above $78,000 on Monday. Ether, after reaching a two-month low on Friday, also edged higher to $2,287. The combined market capitalisation of USDT and USDC fell by about $1.2 billion since Friday, according to CoinMarketCap.

The FBI said the North Korean state-sponsored group TraderTraitor was responsible for the attack. Investigators observed the attackers converting stolen assets into ether and expected further laundering through related technology. Blockchain analysis firms TRM Labs and Chainalysis said the theft unfolded in roughly 20 minutes and resembled previous attacks attributed to North Korea.

US President Donald Trump said on Saturday that North Korea’s involvement had not been established. North Korea’s diplomatic missions in Geneva and China did not respond to requests for comment.

Binance said it used its $1 billion Secure Asset Fund for Users, part of its Futures Insurance Fund and corporate treasury resources to purchase replacement tokens. Co-CEO Yi He said the company would use half of the SAFU reserve and replenish it to about $1 billion. She also warned users about new scams emerging amid the disruption.

Sources: Investing.com News.