Massive capital flight
Binance users pulled $3.6bn in funds after a $6.3bn theft on Thursday. This heist broke the record held by the 2025 Bybit theft where criminals stole $1.5bn. The exchange’s total assets under management currently sit at $171bn. By Sunday afternoon, the platform processed $4.6bn in withdrawals and $1bn in deposits, resulting in a net outflow representing 2.1% of its total assets. I find the $6.3bn loss a staggering security failure, even though the platform managed to handle the surge in withdrawal volumes. Prices fell as Bitcoin dropped nearly 5%, ethereum fell nearly 6%, and BNB tumbled nearly 10%. The scale of the theft shows the capacity of North Korea to find illicit revenue despite extensive international sanctions over its nuclear and missile programmes. Binance set aside $6.34bn of company funds to cover the losses, using its corporate treasury and insurance funds. This massive theft took place on a Thursday.
| Asset Metric | Value |
|---|---|
| Total stolen amount | $6.3bn |
| Net outflow by Sunday | $3.6bn |
| Assets under management | $171bn |
| Stolen amount replenished | 90% |
| Funds frozen by Binance | $3bn |
| Total funds set aside | $6.34bn |
Recovery efforts and network access
The phased reopening of withdrawals provides a functional path to stability. Binance restored access to 15 networks on Sunday, including ethereum, USDT, and USDC on the ethereum blockchain. Users also resumed trading Dogecoin and Avalanche on their own platforms later that day. The company replenished 90% of the stolen amount using its $1bn secure asset fund for users, a bitcoin reserve, its futures insurance fund, and corporate treasury. Richard Teng, the co-chief executive, said that the company will cover the remaining 10% to ensure users do not bear the financial impact. I see that while the company replenished most of the money, the remaining 10% consists of less liquid tokens that may take longer to buy. Binance also stated on Friday that it froze approximately $3bn of the stolen assets. The company confirmed that it replenished the entirety of the Bitcoin, Ethereum, and Tether holdings along with seven other common crypto assets. This recovery process followed an initial investigation suggesting that a compromised engineer’s laptop allowed the attackers to gain entry, though the company later noted that the attackers used other entry points to access the system.
Investigation and North Korean attribution
The FBI confirmed on Saturday that the North Korea-affiliated group TraderTraitor, part of the Lazarus Group, carried out the theft of more than $6bn in virtual assets on or about October 29. The Lazarus Group gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for The Interview, a film mocking the North Korean leader. This complex attack involved a compromised laptop and malicious software that deleted evidence of its activity. The FBI observed TraderTraitor actors converting stolen assets into ethereum and expects those assets to be laundered further by converting them through the use of decentralised finance and instant swap services. I find the FBI’s identification of the Lazarus Group more definitive than the comments from Donald Trump, who told reporters on Saturday night that he does not know if North Korea is responsible and is still gathering information. The US Secret Service is also working with private sector partners to detect, freeze, trace, and recover the stolen assets. The FBI is currently urging private sector entities to block all transactions derived from addresses that TraderTraitor actors use to launder these stolen assets.
