Binance Hack: $3.6 Billion in Withdrawals After $6.3B Theft

Binance faced one of the biggest security crises in its history after hackers stole more than $6.3 billion in virtual assets on October 29. The Federal Bureau of Investigation (FBI) attributed the cyberattack to North Korea, while the world’s largest Cryptocurrency exchange moved quickly to investigate the breach, restore customer services and replace the stolen funds.

The incident triggered a temporary suspension of customer withdrawals and raised concerns about the security of cryptocurrency platforms. As Binance gradually reopened withdrawals, it recorded approximately $3.6 billion in net outflows, placing customer confidence and the exchange’s crisis management under scrutiny.

According to a report by The New York Times, the emergency response involved senior executives, security personnel and cryptocurrency-tracing specialists. Co-CEO Yi He, who was seven months pregnant, reportedly worked through the night from Abu Dhabi, taking calls as late as 3 am to oversee the response.

How the Binance Cyberattack Unfolded

The breach began at approximately 4:20 pm on Thursday, October 29, when unusual transactions triggered security alerts at Binance, according to The New York Times.

The attack reportedly involved a compromised laptop and malicious software designed to erase evidence of its activity. Binance Co-CEO Richard Teng described the incident as a “complex attack”.

As executives assessed the scale of the theft, senior management and security teams coordinated their response through an emergency group on the company’s internal messaging platform. The operation later expanded into a conference call involving around 100 participants, including security personnel and specialists tracking cryptocurrency transactions.

Yi He played a central role in coordinating the response. Despite being seven months pregnant, she reportedly remained involved throughout the night, working from Abu Dhabi and taking calls until approximately 3 am local time.

Binance suspended customer withdrawals as the company investigated the breach and worked to stabilise its systems. The temporary restriction was intended to help the exchange manage the immediate security risks while assessing the impact of the stolen assets.

Binance Records $3.6 Billion in Net Withdrawals

After gradually restoring customer withdrawals on Sunday, Binance recorded net outflows of approximately $3.6 billion in cryptocurrency assets.

Net outflows represent the difference between the value of customer withdrawals and deposits. The figure therefore does not mean that customers withdrew a total of only $3.6 billion.

The exchange said the initial surge in withdrawal activity had eased and that deposits remained substantial. However, blockchain analytics platform DefiLlama reported higher outflows of $4.36 billion.

A Binance spokesperson disputed the accuracy of DefiLlama’s figure, arguing that it did not account for transfers into the company’s own new hot wallet.

How Significant Were the Withdrawals?

Binance said it held approximately $171 billion in assets under management as of October 28, the day before the reported attack.

Against that figure, the reported $3.6 billion in net outflows represented a relatively small share of the exchange’s stated assets. Nevertheless, withdrawal activity remains an important measure of customer confidence, particularly after a major security incident.

The difference between Binance’s reported outflows and DefiLlama’s estimate also highlights the challenges of interpreting blockchain data, where transfers between wallets owned by the same organisation can affect reported figures.

How Binance Plans to Replace the Stolen Cryptocurrency

Binance has committed to absorbing the financial impact of the attack and reimbursing customers in full. The exchange said it had already replaced approximately 95% of the stolen cryptocurrency using its corporate treasury, emergency reserves and insurance funds.

The remaining assets include less liquid tokens that may take longer to source in the required quantities.

Co-CEO Yi He said the company would use 50% of its Secure Asset Fund for Users (SAFU), a reserve established to protect customers against security incidents. Binance has also committed to replenishing the fund to approximately $1 billion.

The exchange said customers would not be required to bear the losses resulting from the attack.

“Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users.”

The commitment to replace the stolen assets is central to Binance’s effort to reassure customers and demonstrate that the breach will not directly reduce their holdings on the platform.

FBI Attributes the Attack to North Korea

The FBI said on Saturday that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29. The agency identified the activity as part of a North Korean cyber operation known as “TraderTraitor”.

According to the FBI, the stolen cryptocurrency was being converted into ether. The agency also warned that further attempts could be made to launder the assets through related technologies.

Blockchain analytics firms have also linked the attack to North Korean hackers, citing similarities with previous cryptocurrency thefts attributed to the country.

Trump Says Responsibility Has Not Been Established

US President Donald Trump said it was not yet clear whether North Korea was responsible for the attack.

“We don’t know if it’s North Korea but if it is, we’ll talk to North Korea about it,” Trump told reporters.

The comments came after the FBI publicly attributed the theft to North Korea. The differing statements underline the importance of distinguishing the agency’s assessment from the president’s remarks.

What the Binance Hack Means for the Cryptocurrency Industry

The attack has renewed concerns about Cybersecurity across the cryptocurrency sector, particularly as digital assets become increasingly connected to mainstream financial activity.

Even major exchanges with substantial resources remain exposed to sophisticated cyberattacks. The reported involvement of a compromised device and malicious software has also drawn attention to internal security practices, rather than just the technology used to store and transfer cryptocurrency.

Binance’s response has received some praise from industry experts, who have highlighted its decision to suspend withdrawals, communicate updates and commit company funds to cover customer losses.

The exchange has also worked with industry partners and US authorities to trace and freeze some of the stolen assets. Such cooperation can be important in cryptocurrency investigations because transactions recorded on public blockchains can provide investigators with information about how stolen funds move between wallets.

Limited Immediate Market Reaction

The immediate market reaction was relatively limited, with most major cryptocurrencies changing by less than 1% on Sunday. Bitcoin was trading at around $78,000, approximately 5% below its level before the theft.

Although the broader market showed a comparatively limited immediate response, the incident has raised questions about the risks associated with holding digital assets on centralised exchanges.

Can Binance Restore Customer Confidence?

Binance’s immediate priorities are to complete the replacement of stolen assets, strengthen its security systems and reassure customers that their funds remain protected.

The reported $3.6 billion in net outflows shows that customers responded to the incident by moving assets away from the exchange, even as Binance worked to restore withdrawals. The company’s commitment to cover the losses and replenish its emergency reserve is intended to limit the financial impact on users.

However, replacing stolen cryptocurrency is only one part of the recovery process. The exchange must also address the security weaknesses that allowed the attack to occur and demonstrate that its systems can withstand similar threats in the future.

For the wider cryptocurrency industry, the Binance incident is another reminder that protecting digital assets requires more than secure blockchain technology. The devices, employees, internal systems and operational procedures used by exchanges are also critical to safeguarding customer funds.

As investigations continue, Binance’s handling of the breach could become an important reference point for how major cryptocurrency platforms respond to large-scale security incidents.