…Exposes $171bn exchange to confidence risks
Binance, the world’s largest cryptocurrency exchange, is facing renewed questions over investor confidence and digital asset security after customers withdrew $3.64 billion following a $6.3 billion security breach linked by the United States Federal Bureau of Investigation (FBI) to a North Korean state-sponsored hacking group.
The withdrawals, representing approximately 2.1 percent of Binance’s $171 billion in assets under management as of October 28, have emerged as an early measure of the financial consequences of the attack, testing whether customers remain willing to entrust their digital assets to the exchange despite its assurances that it has covered most of the stolen funds.
Binance said withdrawals were stabilising after an initial surge, while deposit volumes remained substantial. The exchange has also resumed services, although withdrawals are being processed in phases, with priority given to tokens based on customer demand.
The incident exposes a critical vulnerability in the cryptocurrency industry: the ability of a security breach at a major trading platform to trigger rapid withdrawals, undermine confidence and transmit pressure across digital asset markets.
With 335 million registered users globally, Binance occupies a significant position in the cryptocurrency ecosystem. The scale of the incident therefore extends beyond the exchange itself, raising questions about the security of customer assets, the concentration of digital holdings on centralised platforms and the preparedness of exchanges to withstand sophisticated cyberattacks.
Read also: Binance hack exposes risks in Nigeria’s $59bn crypto market
The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored cyber unit, was responsible for the attack. The agency said investigators had observed members of the group converting stolen assets into ether and expected further laundering through related technologies.
The bulk of the theft reportedly unfolded within approximately 20 minutes late on Thursday, with blockchain analysis firms TRM Labs and Chainalysis identifying similarities with previous attacks attributed to North Korean-linked hackers.
North Korea has repeatedly denied using state-linked cyber units for financial theft and other illicit activities. US president Donald Trump, however, said on Saturday that it remained unclear whether Pyongyang was responsible for the breach.
“We don’t know if it’s North Korea, but if it is, we will talk to North Korea about it,” Trump told reporters.
Binance said it had used its own funds to purchase replacement tokens, covering approximately 95 percent of the stolen assets. It said the remaining five percent comprised less liquid cryptocurrencies that could take longer to source.
The exchange’s response has helped reassure some customers, but the withdrawals and wider market movements suggest that compensation alone may not immediately restore confidence.
DefiLlama, a cryptocurrency analytics platform, initially reported Binance outflows of $4.36 billion before updating the figure to $5.81 billion. Binance disputed the initial figures, saying they did not account for transfers into its new hot wallet and that its own figures, which included both deposits and withdrawals, provided a more accurate picture of customer activity.
Binance said the reported net outflows reflected the difference between customer withdrawals and deposits following the incident.
The distinction is significant because withdrawals do not necessarily represent permanent customer departures. Some investors may be transferring assets to personal wallets or alternative exchanges rather than exiting cryptocurrency markets altogether.
Nevertheless, the scale of the movement highlights the speed at which confidence can influence liquidity on centralised trading platforms.
Ari Redbord, global head of policy at TRM Labs, said the breach could unsettle institutional investors because the risks associated with cryptocurrency exchanges extend beyond conventional financial cybersecurity incidents.
“I get why, for conservative institutional investors, this is unsettling. A hack at a financial institution means stolen usernames and passwords. A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people’s capital,” Redbord said.
The market impact has also extended beyond Binance’s immediate customer base.
Bitcoin, which fell to a six-week low on Friday, recovered slightly over the weekend to trade above $78,000 on Monday. Ether, the second-largest cryptocurrency, also rebounded modestly after reaching a two-month low on Friday, trading at $2,287.
Meanwhile, the combined market capitalisation of the two largest stablecoins, Tether’s USDT and Circle’s USDC, declined by approximately $1.2 billion since Friday, according to CoinMarketCap data.
Spot bitcoin exchange-traded funds recorded $643 million in outflows on Friday, their largest single-day withdrawal in October, while more than $1.3 billion in leveraged cryptocurrency positions were liquidated, according to Redbord.
These movements indicate that the Binance breach is unfolding against a broader backdrop of market sensitivity, where concerns about exchange security can influence investment decisions, liquidity and exposure across the cryptocurrency ecosystem.
The incident also adds to a growing pattern of security threats confronting the industry. TRM Labs estimates that attackers stole $2.9 billion worth of cryptocurrency across nearly 150 incidents last year, underscoring the persistent challenge of protecting digital assets as cryptocurrency adoption expands.
For institutional investors, the implications extend beyond the recovery of stolen tokens to the question of where assets are held and how much exposure should be concentrated on a single exchange.
Jay Koh, vice president at the Asia Web3 AI Association, said he had not withdrawn his holdings from Binance because most of his funds were kept in a cold wallet, which was not affected by the breach.
However, he said investors should reassess their exposure and consider spreading their holdings across different custody arrangements.
“I would not necessarily withdraw everything from Binance … However, I do think it is prudent to review exposure, diversify custody arrangements and avoid keeping more assets on any single platform than necessary,” Koh said.
Binance’s phased withdrawal process initially covered 15 tokens, including bitcoin, ether, selected USDC and USDT-related tokens, and dogecoin.
The exchange said the approach was designed to prioritise assets based on customer demand over the preceding week.
“We are taking a phased approach by prioritising tokens based on the past week data of user demand,” Binance said in an earlier statement posted on X, adding that market conditions were stable.
The recovery of customer confidence will now depend not only on Binance’s ability to replace the remaining stolen assets but also on its capacity to demonstrate that the vulnerabilities responsible for the breach have been addressed.
Read also: Low-liquidity tokens complicate Binance’s effort to cover $6.34bn hack losses
For an exchange holding $171 billion in assets and serving hundreds of millions of registered users, the incident presents a wider test of the cryptocurrency industry’s ability to provide security and custody assurances comparable to those expected of established financial institutions.
While Binance has moved to absorb the immediate financial impact of the theft, the $3.64 billion in customer withdrawals shows that the cost of a major cyberattack is not limited to the assets stolen. It can also extend to the confidence of customers whose funds were never directly affected.
Royal Ibeh is a senior journalist with years of experience reporting on Nigeria’s technology and health sectors. She currently covers the Technology and Health beats for BusinessDay newspaper, where she writes in-depth stories on digital innovation, telecom infrastructure, healthcare systems, and public health policies.
