Binance sees $3.6bn net outflow after record $6.3bn hack
Binance, the cryptocurrency exchange, was hit by a $6.3bn theft on Thursday, which the Guardian says has since been described as the biggest heist in history. The exchange first froze withdrawals while it investigated, then announced on Sunday that it had begun a phased reopening.
The headline figure of $3.6bn pulled from the platform is a net number. By Sunday afternoon Binance had processed $4.6bn in withdrawals and $1bn in deposits, a net outflow of about $3.6bn, or 2.1% of its $171bn in total assets under management. The company confirmed the figures in its latest proof of reserves snapshot, and a full report is expected on Monday. Binance said that after an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial.
The first phase of the reopening restored withdrawals for 15 networks and assets, including ethereum and the USDT and USDC tokens on the ethereum blockchain, plus some others on the BNB Smart Chain. Later on Sunday, dealing in Dogecoin and Avalanche resumed on their own platforms. Binance told customers that market conditions were stable and that its team was testing the remaining networks and assets rigorously. On X it said it would share details of the next phase as soon as it can.
On compensation, Binance said it had replenished 90% of the stolen amount. The remaining 10% of tokens are less liquid and may take longer to buy, the company said in a post on X on Saturday. Co-chief executive Richard Teng said Binance was committed to covering the remaining 10% and that users would not bear the financial impact. Binance said it had set aside about $6.34bn of company funds to cover the losses. The tokens were rebought using part of its $1bn secure asset fund for users (a bitcoin reserve held to protect customers in a security breach), some of its futures insurance fund and its own corporate treasury.
On Saturday the FBI confirmed earlier suspicions from private investigators and analysts that a North Korea-affiliated group called TraderTraitor was behind the hack. The Guardian says TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking Sony Pictures as revenge for The Interview, a film that mocked Kim Jong-un. The FBI statement put the theft at more than $6bn in virtual assets, on or about October 29. It said it had observed TraderTraitor actors converting stolen assets into ethereum and expected them to be laundered further through decentralised finance and instant swap services. It urged private sector entities to block transactions with or derived from addresses the group is using to launder the assets.
Teng said on Friday that the breach was a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity, which made it harder to trace and investigate.
Markets reacted to the news. Bitcoin fell nearly 5%, ethereum nearly 6% and BNB, the token native to Binance, nearly 10%. The Guardian also notes that the hack came as many observers were worried that ever more capable AI models could compromise cryptography and IT security protocols; it does not say AI was used in this attack. The scale of the theft, it adds, has put a spotlight on North Korea's ability to find illicit revenue while under extensive international sanctions over its nuclear and missile programmes.
Key facts
- Binance suffered a $6.3bn theft on Thursday; the FBI's statement says more than $6bn in virtual assets was stolen on or about October 29.
- By Sunday afternoon Binance had processed $4.6bn in withdrawals and $1bn in deposits, a net outflow of about $3.6bn, or 2.1% of its $171bn in assets under management.
- The FBI attributes the theft to TraderTraitor, a North Korea-affiliated group believed to be part of the Lazarus Group.
- Binance says it has replenished 90% of the stolen amount, set aside about $6.34bn of company funds, and will cover the remaining 10%.
- A phased reopening began on Sunday with withdrawals restored for 15 networks and assets; bitcoin fell nearly 5%, ethereum nearly 6% and BNB nearly 10% after the news.
Why it matters
The Guardian reports that the theft, at $6.3bn, has been described as the biggest heist in history and is the largest crypto hack on record. It is also a test of how an exchange behaves after a loss of this size: withdrawals spiked, then Binance says they declined and stabilised, while deposits stayed substantial. The $3.6bn net outflow is 2.1% of the $171bn the platform holds, so the exchange has absorbed the run so far.
Who it affects
Binance customers, whose accounts were the source of the stolen funds and who faced a freeze on withdrawals before the phased reopening. Holders of BNB, ethereum and bitcoin saw prices drop after the news, by nearly 10%, nearly 6% and nearly 5% respectively. Private sector entities are also affected: the FBI is urging them to block transactions with addresses TraderTraitor uses to launder the assets.
How to use it
This is a news story, not a product. For Binance users, the practical points from the source: withdrawals are back for 15 networks and assets, including ethereum, USDT and USDC on the ethereum blockchain and some assets on BNB Smart Chain, with Dogecoin and Avalanche dealing resumed on their own platforms. The remaining networks and assets are still being tested, and Binance says it will share details of the next phase as soon as it can. A full proof of reserves report is expected on Monday.
How solid is it
The outflow, deposit and asset figures come from Binance's own proof of reserves snapshot, as reported by the Guardian, with a fuller report still to come. The North Korea attribution comes from an FBI statement, which confirmed earlier suspicions from private investigators and analysts. The link between TraderTraitor and the Lazarus Group is described only as believed. The sources give slightly different theft figures: $6.3bn in the Guardian's text, more than $6bn from the FBI, and about $6.34bn of company funds set aside by Binance; they are not reconciled. The $3.6bn is a net figure, not gross withdrawals.
Risks and caveats
Ten percent of the stolen amount has not yet been replaced because those tokens are less liquid and may take longer to buy; Binance and Teng say they will cover it. The FBI expects the stolen assets to be laundered further through decentralised finance and instant swap services. No timetable is given for restoring the remaining networks and assets. Teng described the attack as involving a compromised laptop and malware built to erase its traces, which makes it harder to trace and investigate. The Guardian's mention of AI-related worries is general context from observers, not a claim that AI was used in the hack.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident”
— Binance, company statement