Binance users pull almost $5 bln after record crypto heist

Users withdrew $4.9 billion from Binance, the world’s largest crypto exchange, after it began restoring services in phases on Sunday, the Financial Times reports, citing DefiLlama data. Withdrawals were suspended starting on Thursday following a $6.3 billion heist. The amount customers withdrew was equivalent to almost 3% of the value of assets held on the exchange the day before the hack.

Binance reopened crypto token withdrawals on Sunday and began approving fiat withdrawals, including in dollars and UAE dirhams, on Monday. In the first 9.5 hours after withdrawals resumed, the exchange processed $4.65 billion in withdrawals and $1.01 billion in deposits.

The phased approach was designed so that “each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened.” The exchange initially restored access to ether, USDT, and USDC on the Ethereum blockchain, as well as assets on BNB Smart Chain. Other tokens, including dogecoin and solana, were added later. Binance explained that it prioritized tokens based on user demand and warned of possible “temporary delays or longer processing times due to traffic volume.”

To reimburse customers, the exchange set aside funds equivalent to 95% of the stolen assets, drawing on its own revenue and an emergency reserve. It is buying the remaining 5% of tokens in the market, stating that they are “less liquid” and take longer to source at the required scale.

The FBI blamed North Korean hacking group TraderTraitor for the attack on Binance, stating that it expected the funds to be converted and “further laundered.” North Korea-linked groups have become prolific crypto thieves in recent years: last year, for example, the FBI fingered TraderTraitor for the theft of $1.5 billion from crypto exchange Bybit.

Binance’s initial investigation found that an engineer’s laptop had been compromised, but additional “points of breach” were later discovered. Co-CEO Richard Teng said the company was rebuilding and retesting its “entire infrastructure system” and “conducting a full security review across the entire company.” The exchange is working with law enforcement and blockchain analytics companies and has pledged to publish a detailed report on its investigation.