Binance clients withdrew $3.64 billion, equivalent to 2.1% of the assets held on the platform, after the world’s largest cryptocurrency exchange resumed operations. The withdrawals followed last week’s cyberattack, in which hackers stole assets worth $6.3 billion.
The incident is considered the largest cyberattack in the history of cryptocurrencies. According to blockchain analytics firms TRM Labs and Chainalysis, the attackers may have originated in North Korea. TRM Labs said they targeted Binance wallets across 10 blockchain networks and transferred most of the funds in approximately 20 minutes.
Binance said withdrawals stabilized after the initial surge, while deposits remain substantial. The company’s co-founder, Yi He, announced that the platform would cover all losses caused by the attack.
Bitcoin fell more than 3% on Friday, to $76,368, while Ether dropped to $2,178 before recovering on Monday. Binance has 335 million users and held $171 billion in assets under custody as of October 28.
The attack comes amid a wave of crypto thefts. In the previous year, hackers stole $2.9 billion in digital assets across nearly 150 incidents. Analysts warn that the breach could undermine confidence in the entire sector, which is already under pressure from high interest rates in the United States and weaker demand for ETFs.
Context: after the $6.3 billion attack, Binance froze funds and gradually resumed trading
A few days before the period under review, Binance announced that it had been the target of a cyberattack estimated at approximately $6.3 billion and had temporarily suspended deposits and withdrawals. The company said that approximately $3 billion had been frozen on the blockchain to limit the theft, while partners such as Tether and Circle had likewise blocked assets worth billions of dollars ($1.6 billion at Tether and approximately $800 million at Circle).
Subsequently, Binance stated that it had recovered approximately 90% of the stolen assets and that the remaining roughly 10% consisted of less liquid tokens. The company also announced that it would use, among other resources, the SAFU (Secure Asset Fund for Users) fund to absorb the financial impact of the attack, while withdrawals had reportedly resumed after the procedures were confirmed.
.webp)
