Economy

Investors pull billions from Binance after record hack

Net outflow hits $3.6bn as exchange reopens withdrawals in phases, FBI names North Korea's TraderTraitor behind $6.3bn theft

Images

Binance told customers it was testing its networks and assets to ensure deposits were safe. Photograph: Romain Doucelin/NurPhoto/Shutterstock Binance told customers it was testing its networks and assets to ensure deposits were safe. Photograph: Romain Doucelin/NurPhoto/Shutterstock Shutterstock

Investors pulled a net $3.6bn from Binance as the world's largest cryptocurrency exchange reopened withdrawals in phases on Sunday, three days after a $6.3bn theft described as the biggest heist in history. The FBI has attributed the breach to North Korea, confirming what private investigators and analysts had suspected.

By Sunday afternoon the platform had processed $4.6bn in withdrawals and $1bn in deposits, figures the company confirmed in its latest proof of reserves snapshot. The net outflow represents 2.1 per cent of the $171bn Binance holds in assets. The first phase restored withdrawals for fifteen networks and assets, including ethereum, USDT and USDC tokens on the ethereum blockchain; dealing in Dogecoin and Avalanche resumed later in the day.

Binance had frozen withdrawals after Thursday's breach. It has since replenished 90 per cent of the stolen tokens; the remaining tenth are less liquid and may take longer to buy back. Co-chief executive Richard Teng said the company was "committed to covering the remaining 10 per cent" and that users would not bear the financial impact. About $6.34bn of company funds has been set aside for the purpose.

Teng described the attack as "complex", involving a compromised laptop and malicious software built to delete evidence of its own activity. On Saturday the FBI named the perpetrator: TraderTraitor, a group believed to be part of the Lazarus Group, accused of hacking Sony Pictures in 2014 in revenge for The Interview. The Bureau said it had already observed the stolen assets being converted into ethereum and expected further laundering through decentralised finance and instant swap services. It urged private companies to block transactions with the addresses involved.

Binance said withdrawal volumes had declined after the initial spike and were "stabilising as expected", while deposit volumes had "remained substantial". The $6.34bn the company has committed to covering the theft is nearly double the amount customers actually took out. The FBI expects the stolen ethereum to keep moving through instant swap services in the meantime. Binance's full report is due on Monday.