Binance Faces $4.7B Withdrawals After Record $6.3B Crypto Hack

What happened between 29 October and 2 November

The attack took minutes. The recovery took days. The sequence, as reported by Binance, Reuters, TRM Labs and Cointelegraph:

1. 29 October, from 20:05 UTC: funds left Binance wallets on ten blockchains, the bulk of it within 20 minutes. TRM Labs measured $6.36 billion in outflows. By 22:15 UTC Binance had suspended withdrawals.
2. 30 October: Binance and its partners froze $3 billion of the stolen assets. Circle froze more than 800 million USDC, and Tether and Ripple also blocked funds. Binance said it found no evidence of a private key leak.
3. 31 October: the FBI attributed the attack to North Korea and named the group TraderTraitor. Binance moved 7,499 BTC out of its SAFU emergency fund.
4. 1 November: withdrawals reopened in phases after 45 hours, starting with Bitcoin, Ethereum, Solana, BNB Chain, Tron and the XRP Ledger. Binance said it had replenished 95% of affected assets, up from 90% a day earlier.
5. 2 November: US dollar cash withdrawals resumed. Binance published a proof of reserves snapshot showing 10 assets, including BTC, ETH and USDT, backed "at least 1:1".

Binance's preliminary findings point to a compromised laptop belonging to a DevOps engineer as the entry point. The company later said its investigation had found additional points of breach. It has promised more technical detail once the probe is complete.

The FBI attribution is an investigative finding, not a court ruling. No individual has been charged over the attack, and Binance itself has said only that it is working with law enforcement to identify those responsible.

How Binance is covering a $6.3 billion hole

Binance is paying for the loss from three sources: its corporate treasury, the Secure Asset Fund for Users (SAFU), and part of its futures insurance fund (Cointelegraph). The remaining 5% of affected assets are less liquid tokens, which Binance says it is buying through market and over-the-counter trades.

The SAFU fund shows the cost on-chain. Its Bitcoin address held 15,000 BTC before the transfer of 31 October and 7,500 BTC on 2 November, worth $583 million. Binance's own SAFU policy states that if the fund falls below $800 million, Binance "will rebalance the fund to restore its value to $1 billion." The policy sets no deadline for doing so after a security incident. Binance did not answer Cointelegraph's questions on remaining reserves or a replenishment timeline.

Binance plans a second, wider reserve snapshot on Wednesday, 4 November. Until then, coverage beyond the 10 audited assets rests on the company's word.

Why bitcoin did not crash

The numbers that frightened the market on Thursday look smaller next to the size of the exchange. Binance reports more than 335 million users and $95 billion in average daily volume across spot and derivatives. A $4.72 billion net outflow is 2.8% of assets. After the collapse of FTX in 2022, Binance processed $6 billion of net outflows in 72 hours, and survived that too.

Bitcoin hit a six-week low on Friday, 30 October, then recovered through the weekend to trade near $78,000 on Monday. Ether rebounded from a two-month low. US spot Bitcoin ETFs saw $643.33 million in net outflows on 30 October (SoSoValue), which says the selling reached beyond Binance customers. "It has not yet triggered widespread panic," said Tim Sun, a senior researcher at HashKey Group, in comments to Reuters.

The majority of the money that left was USDT, Binance said. In our interpretation, that matters. Customers moving stablecoins to another venue are relocating cash, not dumping bitcoin into the order book. Panic looks different. This looked like people checking the locks.

Not everyone left. Reuters spoke to traders who kept their accounts, and Binance co-CEO Yi He said part of the withdrawals were transfers between Binance wallets.

What the hack means for Canadian investors

Canadian residents had no direct exposure. Binance announced its exit from Canada in May 2023, saying new CSA guidance on stablecoins and investor limits made the market "no longer tenable." The global platform does not accept Canadian accounts.

The indirect exposure is real, and it runs through three channels:

• Price. Bitcoin and ether moved on the news, and Canadian holders on every platform carried the swing.
• Stablecoins. Circle, Tether and Ripple froze funds within hours. Freezes target stolen coins, but they show how fast an issuer acts on a balance.
• Phishing. Binance warned users not to trust unofficial links or messages during the incident. Fake refund pages follow every large hack.

Here the Canadian rulebook offers a contrast. Platforms registered with Canadian securities regulators commit to holding at least 80% of client crypto with an acceptable third-party custodian, to keeping client assets in trust and apart from their own, and to never lending or rehypothecating them (CSA Staff Notice 21-332). The Binance loss came from hot wallets, the online balance an exchange keeps for daily withdrawals. Under the Canadian model, the share a platform holds itself is limited to 20% of client crypto.

None of this makes a Canadian platform immune to an attack. It limits what an attacker reaches. The difference between a 2.8% outflow and a run on the bank is often the size of that pool.