Binance Users Pull $3.6 Billion After $6.3 Billion Mega Hack. What Happens Now?

Binance posted a net outflow of $3.6 billion in cryptoassets after restoring customer withdrawals on Sunday, a relatively soft blow to its overall business in the wake of the largest cyber theft in history, which has been attributed to North Korean hackers.

The world's biggest cryptocurrency exchange posted details of its withdrawals and deposits on social media, saying the flight of funds eased after an initial spike. Binance had frozen withdrawals in the immediate aftermath of Thursday's $6.3 billion hack to investigate and stabilise the situation, and it also pledged to reimburse all customers in full.

Although Binance got its arms around the hack relatively quickly with the help of industry partners and the US government, the digital pilferage has raised fresh questions about the vulnerabilities for cryptocurrencies and whether anyone's money is really safe. The next-biggest attack on Bybit in 2025 was just a fraction of the latest heist.  

Yet many experts were complimentary of Binance's response to the incident, including the speed with which it reacted, the frequent updates it posted publicly to reassure customers and the idea that the platform is using its own profits for reimbursement.

It's also hard to stop doing business with an exchange of Binance's size and scope. The company had $171 billion in assets under management as of Oct. 28, according to its Sunday X post. The next-biggest exchange, OKX, has about $29 billion.

"We won't pull money off," said Vincent Liu, chief investment officer at Kronos Research. "Binance is the platform with most liquidity. If you want to trade or hedge in crypto, you will have to be on Binance. I do expect withdrawals but I also see many will come back as liquidity recovers."

Still, the severity of the hack and its apparent cause -- an employee's compromised laptop -- rattled confidence in Binance's existing cybersecurity protocols and sent shockwaves across the sector earlier this week. 

US government entities including the Federal Bureau of Investigation and US Secret Service have been investigating the attack, which the FBI and blockchain-analytics firms blamed on North Korea. 

The market fallout appears relatively contained so far. The value of most major cryptocurrencies changed less than 1% on Sunday. Bitcoin -- which accounts for about 60% of the sector's market value -- was trading around $78,000, roughly 5% below where it was before the theft.

"On some level, this shows how much the industry has matured," said Haseeb Qureshi, managing partner at venture fund Dragonfly. "We saw extraordinarily quick responses."

Gradual Rollout

Binance has rolled out the withdrawal process gradually. The first phase covered 15 tokens, including Ether and the two biggest stablecoins, Tether's USDT and Circle Internet Group Inc.'s USDC. Withdrawals on 15 blockchain networks including Ethereum, BNB Smart Chain, XRP and Base followed.

Not all of the withdrawals have been from customers because some transfers are between Binance wallets, Co-Chief Executive Officer Yi He said on X.

Binance has so far replaced about 95% of the stolen cryptocurrency using its corporate treasury, as well as emergency and insurance funds. The tokens drained in the attack were a mix of the largest cryptocurrencies across 10 blockchains, including Bitcoin and Ethereum.

"Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds," the company said. "These losses will not be passed on to users."

A spate of attacks this year on crypto firms and the broader financial industry has heightened concerns that artificial intelligence is making hackers more effective -- whatever venue they target. Some security experts believe North Korean hackers have incorporated AI tools into their arsenal, helping especially with reconnaissance and social engineering. 

The heists have exposed serious security flaws in an industry that's pushing into mainstream finance. Hundreds of millions of dollars were drained from Bitget in September. Hackers also stole more than $100 million in Bitcoin from wallets secured by Coinkite Inc. devices, while tampering involving Ledger devices led to millions of dollars in losses.

Other recent cyberattacks have hit prediction market Polymarket, South Korean financial firms Mirae Asset Global Investments and Daishin Securities, as well as Japanese currency trading platform GMO Internet Group Inc.

Quantitative firm SQS Trading had about a quarter of its trading capital on Binance, and planned to cut that by roughly a third, founder Eli Williams said in an interview. That change won't flatten its positions or reduce usage of the exchange as a venue for hedging, he said.

"It's hard to forecast what the net impact will be at this point," Williams said, "but we will be monitoring capital outflows and volume impact relative to other major venues."

Others are holding off on changes altogether, however. Justin d'Anethan, head of research at private markets advisory firm Arctic Digital, said he's not fazed by the latest hack.

"When something seems fishy, it's good to act fast, but when something catastrophic happens, it's better to hold off doing anything," he said. "I haven't and wouldn't move away from Binance."

(Except for the headline, this story has not been edited by NDTV staff and is published from a syndicated feed.)