Binance Covers 95% of $6.3 Billion Hack Impact and Reopens Withdrawals
Key Facts
Binance estimated the total impact of the hack on its hot wallets at about $6.3 billion and said it had covered 95% of the affected amount by November 1, up from 90% in its previous update. The platform announced that it had begun resuming withdrawals in stages that day, setting the first-stage window between 06:00 and 09:00 UTC. By 12:36 UTC, the 15 networks and assets included in the first stage were available for withdrawal. Binance said the remaining 5% involved tokens outside the top ten listed assets, whose lower liquidity was extending the process of making them available. It added that users would not bear the losses and that it would absorb the financial impact of the stolen funds.
In the first nine and a half hours after withdrawals reopened, Binance processed withdrawal requests worth $4.649 billion, compared with deposits of $1.01 billion, according to CoinDesk, citing the company. Net outflows reached $3.64 billion over the same period. Binance said the net figure was equivalent to 2.1% of its $171 billion in assets, according to proof-of-reserves data dated October 28. It said withdrawal requests surged immediately after reopening and then declined, while deposits remained substantial. The company said withdrawal volumes were beginning to stabilize after the initial spike, while deposit flows continued.
The service resumed only partially at first: Binance said Bitcoin withdrawals were restored on the Bitcoin network, and Ether and some dollar stablecoins on the Ethereum network, while service remained partially suspended for most cryptocurrencies. The company said it had worked with blockchain industry partners to freeze affected assets, putting the amount frozen on-chain at about $3 billion as of its October 30 update. Binance said its initial investigation indicated the incident may have begun with the compromise of a laptop belonging to an engineer on the DevOps team, which enabled access to a service container and the submission of unauthorized withdrawal transactions. It said a subsequent investigation uncovered additional points of compromise. It also said its teams had found no evidence of private wallet keys being leaked as of its security update.
Separately, the U.S. Federal Bureau of Investigation attributed the theft of more than $6 billion in virtual assets from Binance to North Korea and named the cyber activity TraderTraitor. The bureau said the attackers converted the stolen assets primarily into Ethereum and expected them to be laundered later through decentralized finance and instant-swap services. Circle said on Monday that it had frozen more than $1.1 billion of USDC among assets linked to the incident. Binance had said its partners were working with law enforcement, blockchain intelligence firms and asset issuers to trace and freeze affected assets. Those efforts are distinct from Binance's coverage of the affected amount, which the company said had reached 95%.
The incident coincided with volatile moves in the Bitcoin market, though EL7 data did not attribute price changes to the hack. The Associated Press said the price fell 3.2% on the evening of October 29 to below $79,000, while EL7 data recorded a close of $77,991.89 that day. The data showed a close of $77,368.77 on October 30, then $77,582.02 on October 31 and $78,354 on November 1. On November 2, the close was $77,894.21. Reuters said Bitcoin fell to a six-week low on Friday before recovering over the weekend and trading above $78,000 on Monday.
Market pressure extended to spot Bitcoin funds, which recorded net outflows of $643 million on Friday, their largest daily outflow in October, while liquidations of leveraged positions exceeded $1.3 billion, according to Reuters. The news agency compared Binance's net outflows with the withdrawal of about $7 billion in USDC during the week Silicon Valley Bank collapsed in 2023, and the withdrawal of about $6 billion from FTX over 72 hours in 2022. A HashKey analyst said the incident had not triggered widespread panic or large, concentrated withdrawals by the time of the comment, but could affect capital-allocation decisions by market makers, institutions and investors. Binance expected to publish additional technical findings after verification within about 48 hours, according to its October 30 update. It said it would publish an incident report after the investigation was complete.