Key Takeaways
- • Binance customers withdrew $3.64 billion, or 2.1% of its assets, as the exchange resumed services on Sunday, November 1, after a $6.3 billion theft, according to Reuters.
- • Binance says it has covered 95% of the $6.3 billion in stolen assets by buying replacement tokens, using company money drawn from its $1 billion Secure Asset Fund for Users (SAFU), its Futures Insurance Fund and corporate treasury.
- • The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored unit, while US President Donald Trump said it remained unclear whether North Korea was responsible.
- • Binance reported $171 billion in total assets under management as of October 28 and 335 million registered users globally.
- • Withdrawal flows are described as stabilizing after an initial spike, making customer trust the key near-term test for the exchange.
Summary
Binance customers pulled $3.64 billion, equal to 2.1% of the exchange's assets, as the world's largest cryptocurrency exchange came back online on Sunday after hackers stole billions from the platform the previous week, Reuters reported. Binance said withdrawals were stabilizing after an initial spike and that deposit volumes remained "substantial." DefiLlama's dashboard showed higher outflows of $5.81 billion, up from $4.36 billion earlier, though Binance said that figure did not include flows to its new hot wallet and was not accurate. Binance did not immediately respond to a request for comment on the updated figures.
Binance said it had covered 95% of the $6.3 billion in stolen tokens, having earlier said it had covered $6 billion by using company funds to buy replacement tokens. The remaining 5% consists of less liquid assets that may take longer to source. Withdrawals are being rolled out in phases, with the first phase covering 15 tokens, including bitcoin, ether, certain USDC and USDT stablecoin pairs and dogecoin. Binance said it is prioritizing tokens based on user demand over the past week. The exchange has about $3 billion of stolen assets frozen as of Friday, working with other crypto firms.
The FBI said on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible, and that members of the unit had converted stolen assets into ether. The agency expected further laundering. Blockchain analysis firms TRM Labs and Chainalysis said the bulk of the theft unfolded in about 20 minutes beginning late Thursday and resembled previous large attacks attributed to North Korea. Trump said later on Saturday that it remained unclear whether North Korea was involved. Pyongyang has denied using state-linked cyber units for theft.
Binance has repeatedly said it will bear the financial impact and has set aside around $6.34 billion of company funds. Co-CEO Yi He said Binance would use 50% of its $1 billion SAFU, a bitcoin reserve, and that the fund would be replenished to about $1 billion. Co-CEO Richard Teng described the breach as a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of activity. Founder Changpeng Zhao thanked US law enforcement for helping track and freeze stolen assets. Reuters also noted that attackers stole $2.9 billion across nearly 150 incidents last year, according to TRM Labs.
Binance said it had covered 95% of the $6.3 billion in stolen tokens, having earlier said it had covered $6 billion by using company funds to buy replacement tokens. The remaining 5% consists of less liquid assets that may take longer to source. Withdrawals are being rolled out in phases, with the first phase covering 15 tokens, including bitcoin, ether, certain USDC and USDT stablecoin pairs and dogecoin. Binance said it is prioritizing tokens based on user demand over the past week. The exchange has about $3 billion of stolen assets frozen as of Friday, working with other crypto firms.
The FBI said on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible, and that members of the unit had converted stolen assets into ether. The agency expected further laundering. Blockchain analysis firms TRM Labs and Chainalysis said the bulk of the theft unfolded in about 20 minutes beginning late Thursday and resembled previous large attacks attributed to North Korea. Trump said later on Saturday that it remained unclear whether North Korea was involved. Pyongyang has denied using state-linked cyber units for theft.
Binance has repeatedly said it will bear the financial impact and has set aside around $6.34 billion of company funds. Co-CEO Yi He said Binance would use 50% of its $1 billion SAFU, a bitcoin reserve, and that the fund would be replenished to about $1 billion. Co-CEO Richard Teng described the breach as a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of activity. Founder Changpeng Zhao thanked US law enforcement for helping track and freeze stolen assets. Reuters also noted that attackers stole $2.9 billion across nearly 150 incidents last year, according to TRM Labs.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.