Binance Reopens Withdrawals After $6.3B Hack

Introduction to the Hack

Binance, the world's largest crypto exchange, has reopened withdrawals after a massive $6.3 billion hack. The exchange was forced to suspend withdrawals temporarily while investigators examined its compromised hot-wallet systems. According to the FBI, the hack was attributed to North Korean hackers, specifically to a group known as "TraderTraitor." This group is believed to be part of North Korea's cyber campaign, which has been involved in several high-profile hacks in the past.

Reopening of Withdrawals

Binance restarted customer withdrawals on Sunday, four days after the hack. The exchange reopened in stages, starting with bitcoin and expanding to 15 networks, including Ethereum, BNB Smart Chain, Solana, XRP, and others. The move marked the first real test of whether the platform could absorb a loss of that size without freezing its customers out for longer. The reopening of withdrawals is a key step in maintaining customer confidence in the exchange. Binance has stated that deposits remained available throughout the rollout, and the exchange warned that users could encounter temporary delays as traffic returns.

Recovery Efforts

The recovery push began on Saturday, with Binance replenishing 90% of the impacted amount using company funds. The exchange drew on part of its Secure Asset Fund for Users, a portion of its futures insurance fund, and its corporate treasury to buy replacement tokens. By Sunday, the exchange had raised coverage to 95% of the impacted amount, with the remaining 5% consisting of less-liquid tokens. Binance has committed to covering the full amount of the losses, ensuring that users will not bear the financial impact of the theft. The exchange has also published a new proof-of-reserves snapshot, giving users a baseline to check their balances against.

Market Reaction and Outflows

The market reacted sharply to the breach, with bitcoin falling about 5% to below $77,000 in the hours after the attack. The outflows from Binance surged, with the exchange recording $5.8 billion in net outflows over the past 24 hours, according to data from DefiLlama. However, the exchange noted that the outflows represented a small portion of the approximately $171 billion in assets it holds. The outflows included approximately $1.083 billion in USDT, $912 million in Bitcoin, $385 million in USDC, and $131 million in wrapped Ethereum. These outflows coincided with Binance's phased reopening of withdrawal services, and the exchange has stated that withdrawals initially surged but have since slowed and are stabilizing.

Investigation and Post-Mortem

The FBI has attributed the attack to North Korea, and the U.S. Secret Service is working with Circle to trace and freeze funds. Tether reported about $1.57 billion in USDT frozen, and Circle said it had frozen more than $800 million in USDC in coordination with authorities. Binance has found additional points of breach beyond the initial compromise, which it originally attributed to a single engineer's laptop. The exchange has not yet published a full post-mortem explaining how the attackers prepared and executed the operation, which some estimates suggest took at least 36 hours of groundwork. The destination of roughly $3.3 billion in stolen funds that were not frozen has also not been fully explained, and the exchange has not detailed what it expects to recover from that pool.

Why it matters

The reopening of withdrawals and the recovery efforts by Binance are key for maintaining customer confidence in the exchange. The fact that Binance has covered 95% of the losses and has committed to covering the full amount is a positive sign for users. However, the hack highlights the importance of security in the cryptocurrency space and the need for exchanges to have solid measures in place to protect user funds. As the investigation continues, it will be important to monitor the situation and see how it unfolds for Binance and the broader cryptocurrency market. The hack also raises questions about the role of regulation in the cryptocurrency space and the need for exchanges to work closely with law enforcement agencies to prevent and respond to such attacks.