Binance customers pull $4.72 billion after $6.3 billion hack

Binance customers withdrew a net $4.72 billion after the exchange reopened withdrawals following a hack that stole about $6.3 billion in crypto. The outflows amount to around 3% of the assets on Binance’s platform, the exchange told Reuters, as users weighed the safety of funds held at the world’s largest crypto exchange.

Binance suspended withdrawals for more than two days after the October 29 attack, then began allowing them again on Sunday, Reuters reported. The confirmed pause was on withdrawals; Binance’s incident notice did not say it halted trading. The exchange said it would cover the stolen funds so customers would not bear the loss.

How did the attacker get in?

Binance’s initial investigation pointed to a compromised laptop belonging to a DevOps engineer. In its security incident update, the exchange said the attacker may have used it to access a service container and submit unauthorized withdrawal transactions. Binance said it had found no evidence that wallet private keys were exposed.

The company put the total impact at about $6.3 billion and said roughly $3 billion of affected assets had been frozen on-chain. A freeze blocks transfers from an address, which can prevent stolen tokens from being moved. Binance said it would cover the losses using its Secure Asset Fund for Users and company funds.

Who does the FBI say was behind the hack?

The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group, Reuters reported. That is the FBI’s assessment; Binance’s initial incident update did not identify an attacker. North Korea denied responsibility in a statement reported by The Associated Press on November 3.

Are withdrawals still running ahead of deposits?

Binance told Reuters it had also received $2.7 billion in customer inflows since Sunday and that withdrawals were stabilising after an initial spike. Most withdrawals were in Tether’s USDT stablecoin, the exchange said. The net outflow figure reflects withdrawals minus deposits, rather than the total amount customers removed.

The withdrawals followed a sharp but temporary pause in access to customer funds. Reuters reported that bitcoin and ether had rebounded by Monday after falling following news of the hack. Binance’s stated loss estimate and the amount frozen may change as its investigation continues.

Sources and documents

• Reuters — live.euronext.com
• security incident update — binance.com