Binance began restoring customer withdrawals in phases after hackers drained over $6 billion in a late October cyber theft, utilizing company reserves to cover the vast majority of stolen funds while law enforcement tied the breach to North Korea.
The Bottom Line
- Binance reopened Bitcoin, Ethereum, and stablecoin withdrawals in phases following a security breach that saw over $6 billion in digital assets drained in approximately 20 minutes on October 29.
- The exchange deployed internal reserves—including the Secure Asset Fund for Users, the Futures Insurance Fund, and corporate treasury funds—to cover roughly 90% to 95% of the losses.
- The Federal Bureau of Investigation formally attributed the attack to a North Korea-affiliated group known as TraderTraitor, heightening scrutiny on illicit state-sponsored cyber operations.
Phased Withdrawal Restoration and Outflow Volumes
As markets processed the scale of the breach, Binance initiated a phased reopening of customer withdrawals following a freeze that lasted more than two days. The world’s largest digital-asset platform reopened Bitcoin withdrawals after 2 p.m. Singapore time on November 1. By the evening in Asia, DefiLlama data showed the exchange recorded approximately $3.5 billion in net outflows, while co-Chief Executive Officer Yi He noted on X that some transfers are between Binance wallets.
The first phase of restored withdrawals covered 15 crypto assets, including Bitcoin, Ether, XRP, and Dogecoin. Ether, BNB, and select USDT and USDC stablecoin withdrawals were also brought back online. The initial reopening targeted more liquid tokens, while remaining less liquid assets would require additional time to acquire and restore.
Internal Capital Deployment and Balance Sheet Impact
To prevent a structural insolvency crisis, Binance relied heavily on its internal liquidity buffers to absorb the shock of the October 29 hack. The platform set aside roughly $6.34 billion of company funds internally to cover the losses, deploying resources from its $1 billion Secure Asset Fund for Users (SAFU) reserve, its Futures Insurance Fund, and its corporate treasury.
Co-CEO Yi He stated that 50% of the SAFU fund was utilized in the immediate aftermath, with management committing to replenish the reserve to about $1 billion. Co-chief executive Richard Teng maintained that users would not bear the financial impact of the breach, emphasizing that the firm was fully committed to covering the remaining tokens.
| Capital Source / Asset Group | Estimated Allocation / Value |
|---|---|
| Total Stolen Assets | ~$6.0B to $6.3B |
| Internal Funds Set Aside | ~$6.34B |
| Covered Stolen Tokens | 90% to 95% |
| Initial Net Outflows (Asia Evening) | ~$3.5B |
FBI Attribution to North Korean State Actors
Law enforcement intervention quickly shifted the narrative from a technical failure to an international security matter. The FBI officially announced that a North Korea-affiliated actor known as TraderTraitor was responsible for the cyber theft, utilizing methods mirroring past state-sponsored campaigns against virtual currency platforms. TraderTraitor actors have historically relied on social engineering tactics, such as posing as recruiters on platforms like LinkedIn to deliver malicious software to employees.
The attack triggered immediate downward pressure across major digital assets. Bitcoin dropped nearly 5%, Ethereum fell nearly 6%, and Binance’s native token, BNB, tumbled nearly 10% following news of the breach. Despite the market reaction, Binance executives publicly thanked U.S. law enforcement agencies for their ongoing support in tracking the stolen assets and investigating the laundering vectors utilized by the threat actors.
Expert Perspectives on Crypto Laundering and Exchange Security
Industry experts and figures familiar with major cyber heists have weighed in on the operational realities facing both perpetrators and defenders following such massive security breaches. Lichtenstein observed that threat actors executing such heists are likely feeling nervous because the stolen Bitcoin resides on a publicly visible blockchain subject to sophisticated analysis tools, and platforms like Tether can freeze funds. He also warned that rapid advancements in artificial intelligence will inevitably lead to drained crypto wallets, noting that in a few months the same hacking technology could be in the hands of a bored kid in a basement. Meanwhile, founder Changpeng Zhao suggested on social media that U.S. law enforcement agencies deserved credit for supporting the market stability, writing, Many crypto bros may not realise, a lot of the ‘why bitcoin didn’t drop more?‘ credit goes to them.
Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute financial advice.
