Binance records $3.64 billion in net outflows as withdrawals resume after record $6.3 billion hack tied to North Korea

Binance recorded $3.64 billion in net outflows after resuming withdrawals on Sunday, as customers moved funds off the platform following a record $6.3 billion hack that the FBI has tied to North Korea.

The exchange processed $4.65 billion in withdrawals and $1.01 billion in deposits between 6 a.m. and 3:30 p.m. UTC on Nov. 1, according to a Binance post on X. The resulting net outflow represented 2.1% of Binance’s $171 billion in total assets, based on its latest available proof-of-reserves data as of Oct. 28. Binance founder and former CEO Changpeng Zhao wrote on X that “98% choose to stay!” and said most of the net outflows occurred within the first couple of hours after withdrawals resumed.

FBI links record heist to North Korea’s TraderTraitor

The FBI attributed the attack to TraderTraitor, a North Korea-affiliated group, and said the theft of more than $6 billion in virtual assets occurred on or about October 29. Richard Teng, Binance’s co-chief executive, said on Friday the breach was a “complex attack” involving a compromised laptop and malicious software designed to delete evidence of its activity. TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking Sony Pictures as revenge for The Interview, a film that mocked North Korean leader Kim Jong-un.

Binance began restoring withdrawals in phases on Sunday, starting with 15 networks and assets. The first phase restored withdrawals for ethereum, USDT, and USDC tokens on the ethereum blockchain, as well as some assets on the BNB Smart Chain blockchain. Services resumed across all 15 networks and assets in the initial phase by 12:36 p.m. UTC. Later on Sunday, dealing in Dogecoin and Avalanche currencies resumed on their own platforms. Binance said testing was continuing for the remaining networks and assets.

Binance pledges to absorb the full loss

Binance set aside about $6.34 billion of company funds to cover the losses, drawing from part of its $1 billion secure asset fund for users, a bitcoin reserve, some of its futures insurance fund, and its own corporate treasury. As of Saturday, Binance said it had replenished 90% of the amount stolen, with the remaining 10% consisting of less liquid tokens. By a later update, Binance said it had covered around 95% of the impacted amount, up from 90% in its previous statement. The exchange said the remaining portion consisted of less liquid tokens that would take longer to source in the quantities required.

Bitcoin plunged nearly 5% after news of the hack, while ethereum dropped nearly 6% and BNB, native to Binance, tumbled nearly 10%. The FBI said it had observed TraderTraitor actors converting stolen assets into ethereum and expected further laundering through decentralized finance and instant swap services. The agency urged private sector entities to block transactions with or derived from addresses TraderTraitor actors were using to launder the stolen assets.

Binance said withdrawal volumes had declined and were stabilizing while deposit volumes remained substantial. A full proof of reserves report was expected on Monday.