Binance $6.3 Billion Hack: Withdrawals Resume Within 45 Hours, Approximately $3 Billion Frozen
nashnova research
Binance suffered a $6.3 billion theft — the largest single hack in crypto history — and pledged to resume withdrawals within 45 hours with full user reimbursement; the real test is whether outflows stay orderly once the gates reopen, which will determine if this becomes a systemic crisis.
What exactly happened?
Binance confirmed Friday that roughly $6.3 billion in assets were stolen across eight chains, with $6.1 billion drained in the first 55 minutes — a single-theft record for the crypto industry.
The attack involved multiple entry points, not just the previously mentioned engineer laptop. This means → the hackers penetrated Binance's internal systems far deeper than initially disclosed, suggesting systemic security gaps.
Withdrawals are suspended and outflows have stopped; deposits remain unaffected.
Can the money be recovered?
Binance says it has coordinated with partners to freeze roughly $3 billion in stolen assets. User losses will be fully covered by the Secure Asset Fund for Users (SAFU, approximately $1 billion) and the company's own capital.
Fidelity digital-asset strategist Sean Farrell estimates the real gap at about $3.3 billion, assuming frozen stablecoins are eventually recovered.
In plain terms = $6.3 billion is the headline loss, but nearly half is already frozen; Binance's out-of-pocket hole is closer to $3.3 billion.
Who did it?
Crypto security firm TRM Labs attributed the attack to North Korean elite hacking group TraderTraitor, citing "on-chain and off-chain intelligence" with "high confidence."
The FBI previously identified the same group as the perpetrator of the $1.5 billion Bybit hack in February 2025. This means → this is not an isolated incident but part of a sustained, state-level campaign against the crypto industry.
TRM Labs listed shared signatures: funding operational wallets via small Tornado Cash deposits — a mixer protocol on Ethereum that obscures fund origins — long pre-attack preparation, and pre-acquired signatures executed in a single burst.
Could Binance collapse?
Farrell's client note concluded: the incident does not currently pose a material solvency risk to Binance.
But he flagged the real systemic-risk chain: client asset shortfall → forced reserve liquidation → accelerated withdrawal runs → counterparty credit withdrawal → cascading deleveraging across crypto. In plain terms = the logic mirrors a bank run — the danger is not how much was lost, but whether everyone tries to withdraw at once.
Farrell also advised that "it is reasonable for Binance users to reassess how much capital they keep on the platform" until the full attack vector is understood.
How hard did markets get hit?
Bitcoin fell 3.5% to $77,901, its lowest in over a month; Ethereum dropped 1.6% to $2,221.49, near a two-month low.
Crypto-linked stocks sold off broadly: Strategy, Circle, and Coinbase each fell more than 4%; Robinhood dropped over 5%.
Coinbase CEO Brian Armstrong blocked the implicated wallets and called for an industry-wide response. This reflects major exchanges actively trying to contain the fallout within Binance and prevent panic from spreading sector-wide.
What to watch next?
The key observation window: whether Binance can resume withdrawals on schedule within 45 hours and whether outflow volumes remain manageable.
This means → if post-resumption outflows are orderly, the event will likely be classified as a massive but contained security incident; if a rush for the exits materializes, it could trigger the cascading deleveraging Farrell described.
Full disclosure of the attack vector is equally critical — until the vulnerability is identified, market trust in Binance will not fully recover.
市场有风险，内容仅供研究参考，不构成投资建议。