What happened?
Binance reopened withdrawals after freezing them for roughly 45 hours due to a theft worth around $6.3 billion. This is reported by CoinDesk. Once access to funds was restored, clients began moving some of their money away.
According to figures the exchange shared, cited by Decrypt and The Block, the net outflow during the first 9.5 hours after reopening amounted to $3.64 billion. That corresponds to 2.1% of the exchange's total assets of $171 billion. The Block also adds that the volume of withdrawals declined after the initial spike.
CoinDesk later reported, in ongoing coverage, a total outflow of around $6 billion, which according to the exchange represents less than 4% of its total holdings.
How much money flowed out? A summary of the numbers
| Metric | Value | Source |
|---|---|---|
| Estimated size of the theft | ~$6.3 billion | CoinDesk |
| Length of the withdrawal freeze | ~45 hours | CoinDesk |
| Net outflow in the first 9.5 h | $3.64 billion (2.1% of assets) | Decrypt, The Block |
| Total outflow (later figure) | ~$6 billion (less than 4% of holdings) | CoinDesk |
| Exchange's total assets | ~$171 billion | The Block |
The numbers come from different moments in the coverage, which is why the individual values vary. These are ongoing data points, not a final accounting balance.
Are withdrawals fully operational yet?
Not entirely. According to The Defiant, the exchange restored withdrawals in US dollars and brought all 15 original crypto network groups back online. However, according to the same source, withdrawals for several other tokens remained suspended. The restoration therefore happened gradually, not all at once.
Who is behind the attack?
According to the headline and reporting by Decrypt, the FBI attributes this hack to North Korea. That would place the attack within a pattern that authorities have long linked to state-backed groups from the DPRK. The exact technical details of the attack, the method of intrusion, and whether and how much of the funds can be recovered do not clearly emerge from the available sources.
The term "net outflow" here means the difference between the money that left the exchange and the money that came in during the same period.
What did this mean for competitors?
CoinDesk reports that while clients were regaining access to their funds, rival exchanges attracted some of the deposits. This is a common reaction to this type of event: some users move their funds elsewhere or into self-custody until the situation becomes clearer.
What to watch in similar cases
With hacks of large centralized exchanges, it is useful to watch three things: the pace and total volume of outflows relative to declared assets, the speed and completeness of restoring withdrawals across tokens, and official statements about the origin of the attack and any compensation for damages. Charliedesk does not give recommendations on what to do with your funds. We only show what happened and what the data says.
What we still don't know
The sources do not confirm exactly how the intrusion occurred, whether the stolen funds will be recovered, or how the total outflow developed in the days after reopening. Likewise, these sources do not document the official text of the FBI's accusation nor any response from North Korea.