Investors have withdrawn a net $3.6bn (£2.7bn) from the cryptocurrency exchange Binance as it recovers from a record hack in which billions were taken from customer accounts.
The platform was hit by a $6.3bn theft on Thursday, described as the biggest heist in history. By Sunday afternoon Binance had processed $4.6bn in withdrawals and $1bn in deposits, producing a net outflow of about $3.6bn, or 2.1% of its $171bn in total assets under management. The figures were confirmed by the company in its latest proof of reserves snapshot, with a full report expected on Monday.
Binance froze withdrawals while it investigated the breach and on Sunday announced a phased reopening. In the first stage it restored withdrawals for 15 networks and assets, including ethereum, USDT and USDC tokens on the ethereum blockchain, as well as some assets held on the BNB Smart Chain blockchain. Later on Sunday, trading in Dogecoin and Avalanche resumed on their own platforms.
The exchange said withdrawal volumes had declined after an initial spike and were stabilising as expected, while deposits had remained substantial. It told customers that market conditions were stable and that its team was testing the remaining networks and assets rigorously, adding that it would share details of the next phase as soon as possible.
Binance said it had replenished 90% of the amount stolen. The remaining 10% of tokens were less liquid, meaning they could take longer to buy, the company said in a post on X on Saturday. Richard Teng, Binance's co-chief executive, said the company was committed to covering that remaining share and that users would not bear the financial impact of the hack.
The exchange said it had set aside about $6.34bn of company funds to cover the losses. The money used to rebuy tokens came from part of its $1bn secure asset fund for users — a bitcoin reserve held to protect customers in the event of security breaches — as well as from some of its futures insurance fund and its own corporate treasury.
On Saturday the FBI confirmed earlier suspicions from private investigators and analysts that a North Korea-affiliated group called TraderTraitor was behind the hack. The agency said the Democratic People's Republic of Korea was responsible for the theft of more than $6bn in virtual assets from Binance on or about October 29. It added that it had observed TraderTraitor actors converting stolen assets into ethereum and expected them to be laundered further through decentralised finance and instant swap services, and urged private sector entities to block transactions connected to the addresses being used.
TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures.
Teng said on Friday that the breach was a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate.
News of the hack hit crypto markets: bitcoin fell nearly 5%, ethereum dropped nearly 6% and BNB, native to Binance, tumbled nearly 10%. The hack also came as many observers expressed worries that the expanding capabilities of artificial intelligence models could compromise cryptography and IT security protocols. The scale of the theft has put a spotlight on the capacity of North Korea, which faces extensive international sanctions over its nuclear and missile programmes, to find illicit means of raising revenue.
Sources: The Guardian Business.