Binance users withdraw $5 billion as crypto exchange restarts services after heist

Unlock Editor’s Digest for free

Roula Khalaf, editor-in-chief of the FT, selects her favorite stories in this weekly newsletter.

Binance users withdrew $5 billion from the world’s largest crypto exchange after its services resumed on Sunday following a record $6.3 billion heist.

The company was robbed Thursday evening and suspended withdrawals as it rushed to repair its platform and investigate how the hackers breached its systems.

Binance said on Sunday it had begun a slow and gradual recovery of its withdrawal services following the hack, blamed on a group linked to North Korea.

As of Monday morning, users had withdrawn a net total of $4.9 billion after withdrawals reopened, equivalent to nearly 3% of the value of assets held on exchanges the day before the hack, according to figures from data platform DefiLlama.

The company first allowed withdrawals of crypto tokens on Sunday and on Monday began allowing fiat withdrawals, including in US dollars and UAE dirhams.

Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits within nine and a half hours after withdrawals began, it announced on Sunday.

The company said its phased approach was designed so that “each network and asset pair can be carefully restored, with stability and security checks carried out before access is reopened.”

Binance began by allowing people holding Ethereum, USDT, and USDC tokens on the Ethereum blockchain to recover their funds, as well as certain assets held on the BNB Smart Chain blockchain. Later on Sunday, he said holders of other tokens, including dogecoin and solana on their respective blockchains, would also be able to withdraw their assets.

Binance said it was prioritizing tokens based on user demand over the past week and that users may experience “temporary delays or longer processing times due to traffic volume.”

The company said it would reimburse customers whose assets were stolen in the hack. He amassed a pot representing 95 percent of the stolen funds, financed by his own income and an emergency fund. He was scrambling to buy the remaining 5% of tokens on the market, saying they were “less liquid” and took longer to supply at scale.

The FBI on Saturday blamed TraderTraitor, a hacking group linked to North Korea, for the theft of the record, saying it expected the funds to be converted and “further laundered.”

Groups linked to North Korea have become prolific crypto thieves in recent years. Last year, the FBI accused TraderTraitor of stealing $1.5 billion from crypto exchange Bybit.

Binance is working with law enforcement and blockchain analytics companies to investigate how the heist happened and said it will release a report on its findings.

The company’s initial investigation found that an engineer’s laptop had been compromised, but it later added that other “points of breach” were discovered.

The scale and speed of the theft shocked the crypto industry. Richard Teng, Binance’s co-CEO, said after the heist that the company was rebuilding and retesting its “entire infrastructure system” and “conducting a comprehensive security review across the entire enterprise.”

“Resuming withdrawals is a major milestone, but our work continues. We will continue to strengthen our safeguards (and) complete the recovery process,” Binance said.