After a 20-minute breach that siphoned roughly $6.3 billion in digital assets, the world’s largest crypto platform has begun to restore withdrawals, signaling a tentative return to normal operations.
Phased reopening of withdrawals
The platform announced a step-by-step rollout, initially unlocking 15 tokens such as Bitcoin, Ether, Dogecoin and several USDC and USDT stablecoins. The selection reflects the assets most requested by users during the week-long freeze.
Analytics firm DefiLlama recorded a net outflow exceeding $3.5 billion on the first Sunday after access was restored, as traders hurried to move funds that had been locked. The exchange noted that the surge has begun to level off, with withdrawal volume tapering in recent hours.
Deposits, however, remained robust, suggesting that inflows continue to offset the outflow pressure. The firm described the withdrawals as a relatively small slice of its overall managed holdings.
How the loss was covered
To compensate for the stolen assets, the company tapped three internal reserves: the Secure Asset Fund for Users (SAFU), the Futures Insurance Fund, and its corporate treasury. By the time withdrawals resumed, about 95 percent of the missing cryptocurrency had been replaced through these mechanisms.
The remaining five percent consists of tokens that are difficult to procure quickly, leaving a modest shortfall that the firm says it is still addressing. No customer balances were reduced; the loss was absorbed entirely by the firm’s own capital.
Established in 2018, SAFU was designed to protect users from unforeseen financial damage, and it has held several billion dollars at various points. Its role in this incident shows why large exchanges maintain dedicated insurance pools.
Binance, founded in 2017 by Changpeng Zhao, widely known by his initials CZ, has grown to become the world’s largest cryptocurrency exchange by trading volume, handling hundreds of billions of dollars each day.
While the replacement assets were bought on open markets, the original funds have not been recovered. Law-enforcement and blockchain analysts continue to track the stolen coins, but state-backed groups typically conceal their trails effectively.
Federal investigators have formally linked the attack to TraderTraitor, a North Korean state-sponsored hacking outfit. The group has a history of targeting crypto infrastructure to fund its government’s weapons programs.
The FBI’s alert titled “North Korea Responsible for $6 Billion Binance Attack” named TraderTraitor as the perpetrator, confirming earlier analyses.
Regulatory fallout and leadership shift
The exchange faced extensive regulatory pressure worldwide before the breach. In November 2023, it agreed to a $4.3 billion package of fines and penalties with the U.S. Department of Justice and other federal agencies, a settlement that also required CZ to plead guilty and serve a four-month prison term.
