Binance has recorded more than $4.7 billion in outflows since it resumed customer withdrawals on Sunday, following a stunning North Korean hack that experts called the largest bank heist in history.
It represents just 3% of the massive cryptocurrency exchange’s total assets and withdrawal levels are already stabilizing to normal levels, a spokesperson for Binance told The Post on Monday.
The Federal Bureau of Investigation said Saturday that the notorious North Korean state-backed cybercrime group TraderTraitor was responsible for the record $6.4 billion heist.
After the hack was first detected Thursday evening, Binance worked with other exchanges and stablecoin providers to quickly freeze about $2.8 billion – falling short of the total stolen sum by roughly $3 billion.
It also paused withdrawals and vowed to cover all losses in full. The crypto exchange said it has since covered 95% of the losses by using company funds to buy replacement tokens, restoring balances in the top 10 coins – including bitcoin, ether, solana and USDT, the US dollar-linked stablecoin.
The remaining 5% of stolen funds were linked to tokens that “are less liquid in the market and take longer time to source at the required scale,” a Binance spokesperson said. “We continue purchasing the remaining affected assets through market and OTC channels.”
Binance co-founder Yi He also said in a post on X Sunday that not all of the outflows are customer withdrawals, and that some are transfers from cold wallets, also known as hardware wallets, to hot wallets.
“Some are large Binance cold wallet transfers to hot wallets, please keep following along!” she wrote with a heart emoji, as translated from Chinese by the social-media platform.
Crypto-related assets dipped Friday following news of the attack, but the industry has remained surprisingly resilient. Bitcoin traded at $77,622.89 on Monday, little changed after dropping below $80,000 last week for the first time in a month.
Binance said Monday that its balance sheet still boasts $157 billion in current total assets even after the heist, customer withdrawals and subsequent market fluctuations.
Binance set aside over $6 billion of company funds to cover customer losses, including half of its $1 billion Secure Asset Fund for Users, or SAFU, and its own corporate treasury.
On Saturday, the exchange said it was committed to replenishing SAFU to return it to roughly $1 billion.
“Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users,” a Binance spokesperson said in a statement.
“Resuming withdrawals is a major milestone, but our work continues. We will continue strengthening our safeguards, completing the recovery process, and providing updates as progress continues.”
The Binance attack comes amid a surge in crypto hacks this year, fueled by the rise of AI models that are able to detect unknown flaws in exchanges known as “zero-day vulnerabilities.” AI tools have been able to target more secure cold wallets, enabling hackers to carry out much larger heists.
Roughly $1.2 billion was stolen in 255 hacks from July to September, up from $822 million in 222 incidents from April to June, according to data from blockchain security firm CertiK.
A massive $1.5 billion heist targeting crypto exchange Bybit last year was also pinned on TraderTraitor, the North Korean cybercrime group tracked by the FBI.
The North Korean hackers were also suspected of carrying out a $350 million heist targeting Bitget, another crypto exchange, in September.
Members of the hacking unit were found to be converting stolen Binance assets into ethereum, another cryptocurrency, the FBI said in a statement, adding that it expects “further laundering” of the tokens.
It’s a telltale marker of TraderTraitor, which is known for pulling off unparalleled lootings by using algorithms to quickly spread the stolen riches across global crypto networks – making them virtually impossible to recover. US officials have said cybercrime attacks fund roughly half of North Korea’s missile program.
Binance said the security incident may have involved a compromised employee laptop. Richard Teng, co-CEO of Binance, later said the firm’s security team also “uncovered additional points of breach,” suggesting it was a complex attack involving more than one hacker.
