NewsCryptoBinance Hack Triggers $3.64 Billion in Outflows as FBI and Secret Service Open Probes

Binance Hack Triggers $3.64 Billion in Outflows as FBI and Secret Service Open Probes

Author: Decrypt·

Key Takeaways

  • •Attackers stole roughly $6.4 billion from Binance hot wallets across about 10 blockchains, more than four times the previous record set by the $1.5 billion Bybit theft, with both attacks attributed to the North Korea-linked TraderTraitor group.
  • •The breach resulted from failures in Binance's signing approval process, starting with a compromised DevOps engineer's laptop, and no private keys were leaked.
  • •Binance has set aside more than $6.34 billion, including about $5 billion already held in the stolen tokens, and must purchase roughly $1.3 billion of BTC, ETH and BNB to replenish its reimbursement pool.
  • •The FBI and U.S. Secret Service have opened investigations, and CFTC Chairman Michael Selig said the hack shows offshore exchanges should register with the agency and meet U.S. cybersecurity standards.
  • •Bitcoin ETFs recorded $643.3 million in net outflows on Friday, flipping October to a $515.9 million net outflow, while Ether ETFs posted $1.61 billion in outflows for their worst month since launch.
Binance Hack Triggers $3.64 Billion in Outflows as FBI and Secret Service Open Probes

Decrypt’s Morning Minute is a daily newsletter written by Tyler Warner. The analysis and opinions expressed are his own and do not necessarily reflect those of Decrypt.

Binance hack weighs on crypto markets

Crypto majors were mixed over the weekend after attackers drained roughly $6.4 billion from Binance hot wallets across about 10 blockchains. Most of the funds were taken within 20 minutes on Thursday afternoon, around five minutes after the market’s closing bell. The loss is more than four times the previous record, the $1.5 billion Bybit theft in February 2025. Both companies have attributed the attacks to TraderTraitor, a North Korea-linked group that also targeted Bybit.

Binance initially blamed a compromised laptop belonging to a DevOps engineer before identifying “additional points of breach.” On Ethereum, the attacker used 50 pre-signed authorizations to turn a Binance hot wallet into a contract that emptied itself. The incident involved a failure in Binance’s signing approvals, rather than a problem with Ethereum, and no private keys were leaked. The attacker also wiped its tooling while leaving the system. The distinction places the focus on exchange security controls and signing procedures rather than on an underlying blockchain failure.

Binance reopened withdrawals over the weekend. QCP reported $3.64 billion in net outflows after withdrawals resumed. Binance CEO Richard Teng said the company would cover every dollar using corporate funds and the Secure Asset Fund for Users, or SAFU. More than $6.34 billion has been set aside, including approximately $5 billion already held in the same tokens that were stolen. Binance co-founder Changpeng Zhao, known as CZ, said: “It hurts, but we survive.”

The FBI and the U.S. Secret Service have opened investigations into the incident. The FBI confirmed that it is “working with public and private partners to assess its scope and coordinate investigative steps.” Further reporting on the probes was published by Decrypt.

CFTC Chairman Michael Selig told CNBC that the hack “proves our exact point” concerning the rules his agency proposed earlier this month. “The real issue here is that these are unregulated offshore exchanges, and they don’t have the same sorts of safeguards,” Selig said. He has proposed a “federal option” under which offshore venues could register with the CFTC and meet U.S. cybersecurity standards. Selig also said the security breach came “from someone’s laptop,” rather than from a blockchain. Decrypt reported separately on Selig’s comments.

Bitcoin ETFs reverse October gains

The Bitcoin exchange-traded funds recorded $643.3 million in net outflows on Friday, their largest outflow day of the month and the end of a four-session buying streak. The single session moved October’s monthly total from a $127 million net inflow to a $515.9 million net outflow. September had recorded $2.65 billion in net inflows. Decrypt previously reported on Bitcoin ETF investor withdrawals.

Ether ETFs recorded $156 million in outflows on Friday and $1.61 billion for October, their worst month since launch. They entered the weekend on an 11-session losing streak. Together, the exchange withdrawals and ETF figures provide separate measures of immediate Binance-related flows and broader fund activity.

The newsletter said Monday’s fund flows would be closely watched. It also reported that Binance would need to purchase approximately $1.3 billion of BTC, ETH and BNB through the open market and over-the-counter transactions to replenish the reimbursement pool. The reimbursement plan and Binance’s asset allocation were detailed in Decrypt’s report.

Prices, markets and other developments

Bitcoin was down 0.3% at $77,600, while ETH gained 1% to $2,280. SOL fell 1% to $94, HYPE declined 3% to $86, and ZEC was unchanged at $1,245. There were no notable altcoin movers.

Oil fell 4% to $99 and gold rose 0.3% to $3,910. U.S. stock futures were higher as oil prices declined and technology stocks rebounded, with the Dow Jones Industrial Average up 0.35% and the Nasdaq up 0.7%.

Elon Musk responded with a grimacing emoji to a post estimating that Binance had suffered $1 billion in losses. CZ replied: “Elon, have a lot of respect for you, but bad time to troll. Please stop.” CZ also said that Binance’s SpaceX shares, acquired through the company’s $500 million stake in the Twitter takeover, are now “worth more than a billion.”

Issuer objections to tokenized share trading on OKXICE reached 50 companies. Nvidia, Micron, Nike, Costco and Reddit were among the latest companies to opt out, leaving 12 of the 62 names that the OKX-ICE joint venture originally planned to list. The number of companies objecting was also reported by WuBlockchain.

Meme coins, protocols and NFTs

Meme-coin leaders were slightly lower: DOGE fell 1%, SHIB 2%, PEPE 2%, PENGU 3% and BONK 3%. TRUMP gained 2% and SPX gained 1%.

Robinhood chain leaders were mixed. Pons fell 4% to $155 million, Cashcat rose 7% to $100 million and AI declined 5% to $62 million. Orbio gained 20% and WTH rose 15%, leading the top movers. Solana’s top movers included Anakin, up 120%; Gato, up 50%; and Choo, up 90%. Stonk fell 7% to $92 million.

Pump.fun led on-chain protocols in daily revenue at $1.42 million, followed by Hyperliquid at $1.23 million and Collector Crypt at $315,000, according to DefiLlama.

Crypto card issuer KAST said it will end Points earning on November 30 and replace the program with KAST Pioneer Units, a new loyalty credit for early users.

NFT leaders were also mixed. Punks rose 2% to 30.4 ETH, while BAYC fell 5% to 5.92 ETH and Pudgy declined 5% to 2.37 ETH. Quotrons gained 15% and Argonauts rose 13% to lead the top movers. ACK changed the artwork on Argonauts to “max pain v3”; the consequences of the change were unclear. The Argonauts collection is available on OpenSea.