Customers of Binance withdrew a net $3.64bn (£2.72bn) from the world’s largest cryptocurrency exchange on Sunday as it reopened following a hack last week that affected $6.3bn worth of digital assets.
The firm had suspended all transactions in the wake of the incident, which is said to be the largest hack in history. Major organisations including the US Federal Bureau of Investigation have accused North Korea of responsibility, and the FBI on Saturday published a list of cryptocurrency wallet addresses linked to the group it names, urging partners in the industry to help block transactions involving them.
Binance set out Sunday’s flows on X. “Between 06:00 and 15:30 [GMT] on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion,” the company said. There had been an “initial spike” in withdrawals, which later declined and were “stabilising as expected”, it added.
The exchange put the day’s net withdrawals at just over 2 per cent of the $171bn of assets it has under management.
Binance said it has covered around 95 per cent of the assets stolen in the breach, and that the remaining amount may take longer to source. It has repeatedly said it would cover all of the losses linked to the attack. “Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the firm said. Last week it said it had reserved more than $6.34bn in funds to deal with the fallout.
The company said it had replaced customers’ assets using a combination of sources, including its corporate treasury as well as its futures insurance and emergency reserve funds.
Withdrawals of more than two dozen major cryptocurrencies, among them Bitcoin and Ethereum, have resumed, and Binance said more services would restart in phases once security checks were completed.
Early checks suggest the incident may have started with a compromised laptop belonging to an engineer, which allowed unauthorised transactions to be made. The hack hit the global centralised exchange at Binance.com; the firm’s US-facing platform has said it was not affected. The figures were reported by the BBC.
The phrase to sit with is “net outflow”, because it is doing a great deal of work in plain sight. A net outflow is what remains after the money coming in has been subtracted from the money going out, and the method treats the two as the same kind of event.
On the day the largest exchange in the world reopened after the largest hack in history, $1.01bn arrived. Those deposits were subtracted from the withdrawals, and the resulting figure was offered to the market as a reading of customer confidence. Confidence, on this method, is a difference.
Our analysts, following the convention to its end, note that the hack itself belongs in the same column. Someone removed $6.3bn from the exchange without submitting a withdrawal request, which is a procedural failing rather than an accounting one. Netted properly, the week’s outflow was closer to ten billion dollars, of which about a third was requested by the owners of the money.
The deposits side then balances it. Binance reserved more than $6.34bn and has paid about 95 per cent of the stolen assets back in, which is an inflow by any definition and a substantial one. The exchange has, in effect, made a deposit with itself.
The Department of Unnecessary Research has worked the books through on this basis and reports that they very nearly close. $6.3bn left. $6.34bn was set aside to put it back. $4.649bn was withdrawn, $1.01bn arrived, and just over 2 per cent of assets under management moved. Everything has been accounted for and returned approximately to where it started.
One item remains open. The largest single movement of money in the exchange’s history was not a withdrawal, not a deposit, and not, after reimbursement, a net anything. In the records it survives as a laptop.