Binance reopened the doors after a $6.3 billion hack, and $3.6 billion walked straight out

$6.3 billion gone on a Thursday, and by Monday morning Bitcoin was back near $78,000. That sentence should not make sense. A theft that big, on the biggest crypto exchange in the world, should have left a much bigger hole in the market. It did not, and the reason why is worth a closer look than the headline number.

Let me say my position plainly, before the numbers. I think Binance did the one thing that mattered most, which was to pay to replace what was taken, fast. I also think that does not settle the bigger question. An exchange can replace stolen coins and still have the same weak door the thieves walked through. Both things can be true at once.

Thursday to Monday, in short

1. Late on Thursday, attackers drained about $6.3 billion from Binance hot wallets, the online wallets an exchange uses for day to day withdrawals. It is the largest crypto theft on record.
2. On Saturday, the FBI named TraderTraitor, a hacking group linked to North Korea, as behind the attack. Reports traced the break-in to a compromised DevOps laptop and other entry points. Binance said no private wallet keys were leaked.
3. On Sunday at 06:00 UTC, Binance started letting withdrawals out again, in phases. The first phase covered 15 tokens and networks, including Bitcoin, Ether, and some USDT and USDC routes. By 12:36 UTC, Binance said all 15 were live.
4. By 15:30 UTC on Sunday, users had pulled out $4.649 billion and put back in $1.01 billion. That leaves a net outflow of $3.64 billion in about nine and a half hours. Binance put that at 2.1 percent of the $171 billion in assets it held, based on proof of reserves data from October 28.

That 2.1 percent is the number I keep coming back to. It sounds small, and in one sense it is. Most customers did not run. Deposits stayed, in Binance's own words, substantial, and withdrawal volumes fell back after the first rush. But $3.64 billion is still a lot of people deciding, on the same day, that they would rather hold their own coins than leave them on the exchange.

The other number that matters is 95 percent. That is how much of the stolen amount Binance said it had now replaced, up from 90 percent on Saturday, using company money and its Secure Asset Fund for Users, known as SAFU. Partners also froze about $3 billion of the stolen funds, including $1.56 billion in USDT and $800 million in USDC. That freeze work matters, because stolen coins that cannot be moved are stolen coins that cannot be cashed out quietly.

So what does that tell us? First, that a big exchange with deep pockets can absorb a hit that would have killed a smaller one outright. Think back to FTX in 2022. Bitcoin fell 19 percent in three days then, as a liquidity crunch turned into bankruptcy. This time Bitcoin fell about 4 percent from its Thursday high, touched a six-week low on Friday, and then climbed back above $78,000 over the weekend. Ether sat near $2,280. The market treated this as a Binance problem, not a crypto problem. That is a real change from four years ago.

Second, the reopening is far from finished. As of late Sunday morning in the United States, withdrawals were still suspended for 531 of 552 listed coins, with another 14 only partly restored. If your coin was not in the first 15, you were still waiting. A fresh proof of reserves report was due on Monday, and until that lands and the next phases open, the story is only half told. United States spot Bitcoin ETFs also lost $643 million on Friday, their largest daily outflow since June. Bitcoin holding near $78,000 is not the same as Bitcoin feeling safe.

My own rule after a week like this

I keep trading money on an exchange, because that is where trading happens. I do not keep savings there. Not after a week like this, and not really before it either. A cold wallet, the kind that stays offline until you need it, is slower and a bit annoying. That slowness is the whole point. A thief cannot drain a wallet that is not connected to anything.

That is not a call for everyone to pull everything off every exchange tomorrow. Panic moves cause their own mess, and Binance, to its credit, is still standing and paying out. It is a simple split that has served me well. Money you plan to trade soon can sit where you trade it. Money you plan to keep for months or years should sit somewhere only you control. If an exchange ever has to tell you to wait for your own coins, you will be glad the second pile was never there.

One last thing I want to be honest about. I do not know yet whether Binance fixed the actual hole, or only paid for what came through it. A DevOps laptop, a hot wallet setup, a process that let one break-in turn into $6.3 billion, those are the details that decide whether this happens again. Replacing coins is generous. Fixing the door is what earns trust back over time. I will be watching the next phases, and that proof of reserves report, before I call this one closed.

Cover image: AI-generated