Binance Loses $3.6bn in Net Outflows After Record $6.3bn Hack

Investors pulled a net $3.6bn (£2.7bn) from Binance in the three days after a record $6.3bn theft hit the crypto exchange, the company's latest proof of reserves snapshot shows. That outflow equals just 2.1% of the exchange's $171bn in total assets under management.

The hack, which struck on or about October 29, has been described as the biggest heist in history. On Saturday the FBI confirmed it attributed the theft to TraderTraitor, a North Korea-affiliated group believed to be part of the Lazarus Group — the collective accused of hacking Sony Pictures in 2014 as revenge for The Interview, a film that mocked North Korean leader Kim Jong-un.

"The Federal Bureau of Investigation is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6bn in virtual assets from cryptocurrency exchange Binance, on or about October 29," the agency said.

How much money actually left?

Binance froze withdrawals while it investigated the breach, then announced a phased reopening on Sunday. By Sunday afternoon, the exchange had processed $4.6bn in withdrawals against $1bn in deposits — a net outflow of roughly $3.6bn. A full proof of reserves report is expected on Monday.

Binance said that "after an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial." The exchange told customers that "market conditions are stable" and that its team was "testing rigorously the remaining networks and assets."

The net figure is the number to watch, and so far it's small relative to the platform's $171bn book.

What has reopened so far?

The first phase restored withdrawals for 15 networks and assets:

• Ethereum and USDT and USDC tokens on the ethereum blockchain
• Several assets held on the BNB Smart Chain
• Later on Sunday, Dogecoin and Avalanche dealing resumed on their own platforms

"We know how important safe and reliable access to your funds is and will share details of the next phase as soon as we can," the company said on X.

Access is coming back asset by asset, not all at once.

Who pays for the losses?

Binance said it has replenished 90% of the stolen amount. The remaining 10% of tokens are less liquid and may take longer to buy back, the company said in a post on X on Saturday.

Richard Teng, Binance's co-chief executive, said the company was "committed to covering the remaining 10%" and that users would not bear the financial impact of the hack. Binance has set aside about $6.34bn of company funds to cover the losses.

"Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident," the company said.

The rebuying money came from three pots: part of its $1bn Secure Asset Fund for Users, a bitcoin reserve held to protect customers in security breaches, plus some of its futures insurance fund and its own corporate treasury. Binance is eating the loss, not its customers — for now.

How did the attack work?

Teng said on Friday that the breach was a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity, making the hack harder to trace and investigate.

The FBI said it had observed "TraderTraitor actors" converting stolen assets into ethereum, and expected those assets to be laundered further through decentralised finance and instant swap services. It urged private sector entities "to block transactions with or derived from addresses TraderTraitor actors" were "using to launder these stolen assets."

What did the market do?

Bitcoin plunged nearly 5% on news of the hack. Ethereum dropped nearly 6%, and BNB, the token native to Binance, tumbled nearly 10%.

The attack landed as many observers warn that ever-expanding AI capabilities could compromise cryptography and IT security protocols. It also put a spotlight on North Korea's capacity — under extensive international sanctions over its nuclear and missile programmes — to find illicit ways to capture revenue.

The next signal comes Monday, when Binance publishes its full proof of reserves report.