Binance sees outflows stabilising as exchange returns online after $6.3 billion heist

Binance customers pulled $3.64 billion, or 2.1% of its assets, as the world’s biggest cryptocurrency exchange resumed service after a security breach linked to North Korea saw $6.3 billion stolen from the platform last week.

The exchange moved to reassure crypto investors and said withdrawals were stabilising after an initial spike and deposit volumes had remained “substantial” after, what analysts believe, may be the world’s biggest financial robbery ever.

After hitting a six-week low on Friday, bitcoin prices recovered slightly through the weekend to trade above $78,000 on Monday. Ether hit a two-month low on Friday and also recovered a little to $2,287.

Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally. It said on Sunday it had $171 billion in total ⁠assets under ​management as of October 28.

The Binance theft adds to a string of recent crypto thefts. Attackers stole $2.9 billion worth of cryptocurrency across nearly 150 incidents last year, according to researchers at TRM Labs.

Withdrawal levels are an early test of whether customers still trust Binance with their money after the attack. The exchange said it had covered 95% of the assets stolen in the heist.

Stablecoin market capitalisations tend to fall when money is leaving cryptocurrencies and they have dropped since Friday. The combined capitalisation of the two largest stablecoins, USDT and USDC, has dropped by ​about $1.2 ​billion since Friday, according to Coinmarketcap.com.

Story continues below this ad

Spot bitcoin ETFs shed $643 million on Friday, the largest daily outflow of ⁠October, and more than $1.3 billion in leveraged positions were liquidated, said Ari Redbord, global head of policy at US blockchain analysis firm TRM Labs.

“I get why, for conservative institutional investors, this is unsettling,” Redbord said.

“A hack at a financial institution means stolen usernames and ‌passwords. A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people’s capital.”

Phased withdrawals

Binance said on Sunday it had covered $6 billion of stolen cryptocurrencies by using its money to buy replacement tokens. The remaining 5% of stolen tokens consist of less liquid assets and may take longer to source, it said.

Story continues below this ad

Despite those measures, some users were weighing options to hedge risks.

Jay Koh, vice president at the Asia Web3 AI Association, said he had not withdrawn any of his holdings from Binance, as most of his funds were held in a cold wallet, which was not impacted by the hack.

“I would not necessarily withdraw everything from Binance … However, I do think it is prudent to review exposure, diversify ⁠custody arrangements and avoid keeping more assets ⁠on any single platform than necessary.”

Binance, which was founded in China, said the rollout for withdrawals would be carried out in stages, prioritising user demand. The first phase covered 15 tokens including bitcoin, ether and those involving some ⁠USDC and USDT stablecoins and dogecoin.

Story continues below this ad

“We are taking a ‌phased approach by prioritizing tokens based on the past week data of user demand,” Binance said in an earlier article posted on ​X.

It added, “Rest assured that market conditions are stable.”

Binance said the net outflows reflected what clients had withdrawn ‌and deposited after the event.

Crypto analytics platform DefiLlama said on its dashboard that outflows were higher, at $5.81 billion, up from the $4.36 billion it showed earlier. Binance did not immediately respond to a request for comment on the updated figures.

“This figure does not contain the flows we have deposited ‌to our own new hot wallet, so ​they are not accurate. ​Our last update on X ​is closest to accurate (outstanding the moves in both deposits and withdrawals since it was posted),” a spokesperson for Binance said of the initial DefiLlama data.

Story continues below this ad

FBI ties attack to North Korean unit

The FBI said on Saturday that the North Korean state-sponsored unit known ​as TraderTraitor was responsible for the attack.

Pyongyang has for years denied using state-linked cyber units for espionage, financial ⁠theft and revenue generation. Its mission in Geneva and embassy in China did not respond to requests for comment.

Law enforcement observed members of the unit converting stolen assets into the cryptocurrency ether, the FBI said in a statement, adding that it expected “further laundering” of the assets through the use of related technology.

Analysts had also pointed to North Korea’s ‌involvement. The bulk of the theft ⁠unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.

Story continues below this ad

US President Donald Trump, however, later on Saturday said it remained unclear whether North ​Korea was involved.

“We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it,” Trump told reporters in comments posted by a White House account on X.