Cryptocurrency exchange Binance says withdrawals stabilized after investors pulled out $3.64 billion over a nine-hour period on Sunday, following last week’s heist, which North Korea is blamed for.
The FBI said on Saturday that it believed a North Korean actor identified as “TraderTraitor” was responsible for the $6.3 billion heist, which took place on Thursday.
Binance said, in a post on X on Sunday, that after an “initial spike,” withdrawal volumes have declined and are stabilizing as expected, while deposit volumes have remained substantial.
“Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds, and Binance can resume operations,” Binance co-CEO Yi He said in a post on X on Monday.
He also sought to differentiate Binance from other cryptocurrency exchanges, such as FTX, which collapsed in November 2022. FTX founder Sam Bankman-Fried was later jailed for 25 years for fraud.
“Look at some fraudulent exchanges that absconded, P2P platforms, and commercial banks: their ledgers are opaque; once the website is shut down, they simply abscond with the funds, the company is liquidated or goes bankrupt, and all they need to do is give you an arbitrary excuse,” He said in a post on X, which responded to another tweet that mentioned FTX.
Binance says it has more than 335 million users globally, and trades $95 billion of digital assets and derivatives daily.
The exchange was attacked Thursday evening in an incident that private blockchain analysis firms TRM Labs and Chainalysis identified as carried out by North Korean state-backed hackers.
Binance said on Thursday that the heist, potentially linked to an engineer’s laptop, affected $6.3 billion in crypto assets—making it the biggest heist in history.
The exchange said it raised $6 billion from its corporate treasury, an insurance fund, and a fund set aside for security breaches to cover the losses from Thursday’s hack.
In a Sunday post on X, Binance’s other co-CEO, Richard Teng, thanked customers for their “patience, understanding, and continued trust.”
“We’ve now replenished approximately 95 percent of the impacted assets, and our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.
Tim Sun, a senior researcher at HashKey Group, a digital asset financial services company in Hong Kong, said the hack had not caused a fatal drop in confidence in Binance or cryptocurrency in general.
No ‘Widespread Panic’
“It has not yet triggered widespread panic or a massive, concentrated withdrawal,” Sun said.
“However, the blow dealt to market confidence by this incident likely extends far beyond the stolen assets … rather, concerns over security will affect the allocation levels of market makers, institutions, and various investors alike.”
President Donald Trump was asked about the Binance hack by reporters on Oct. 31.
“I’m not concerned,” Trump said. “We’re learning about it. We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it.”
Trump said on Oct. 12 that he might meet with North Korean leader Kim Jong Un during his planned visit to Asia later this month.
“I may. That will be exciting, won’t it? But I get along with him,” Trump said.
He is due to attend the Asia-Pacific Economic Cooperation summit in Shenzhen, China, scheduled for Nov. 18–19.
North Korea has a history of deploying state-backed hackers to steal money in cyber heists.
In 2016, members of North Korea-based Lazarus Group tried to steal $1 billion from the Bangladesh Bank by hacking into the SWIFT bank transfer system. In the end, they only got away with $81 million.
US Secret Service Investigating
The U.S. Secret Service stated on X on Sunday that it was continuing to investigate the Binance heist.
“Within minutes of the incident on Thursday afternoon, Secret Service investigators worked with industry partners to identify and freeze a significant portion of stolen cryptocurrency,” it said.
The FBI has posted a list of dozens of Ethereum addresses, 19 Bitcoin addresses, and one Solana address that the Secret Service says “are holding or have held assets from the theft.”
Chainalysis said in a post on X on Sunday that the North Korean actors behind the hack had begun a new phase of money laundering.
“After draining $500M from TRON staging wallets, the launderers have started moving onto Solana,” Chainalysis stated.
Reuters contributed to this report.
We had a problem loading this article. Please enable javascript or use a different browser. If the issue persists, please visit our help center.