NewsCryptoBinance Hack: Why Bitcoin Didn't Crash Like It Did in 2018

Binance Hack: Why Bitcoin Didn't Crash Like It Did in 2018

Author: Decrypt·

Key Takeaways

  • •The $6.4 billion theft from Binance is the largest crypto hack on record, more than four times the previous record of $1.5 billion set by the Bybit breach in February 2025.
  • •Bitcoin dropped roughly 6% to about $76,400 by Friday and remained down about 4% a day after the breach, with more than $1.3 billion in leveraged positions liquidated.
  • •Binance has committed more than $6.34 billion of company funds to cover all losses, is buying back the missing tokens on the open market and over the counter, and says about $3 billion of the stolen funds has been frozen.
  • •Blockchain analytics firms Chainalysis and TRM Labs link the attack to the North Korean group behind the Bybit heist, which previously converted about 84% of its stolen Ethereum into Bitcoin through Thorchain.
  • •U.S. spot Bitcoin ETFs, which hold roughly 1.3 million BTC or about 6% of total supply, are viewed as a key stabilizing force, and Friday's fund flow figures will give the first indication of whether these holders are selling.
Binance Hack: Why Bitcoin Didn't Crash Like It Did in 2018

Bitcoin slipped to roughly $76,400 on Friday, about 6% below its level after Wednesday's Federal Reserve decision, following a record $6.4 billion hack of Binance. The move is mild by the standards of crypto's worst security failures: in March 2018, a failed attack on the same exchange knocked nearly 11% off Bitcoin's price within minutes, even though Binance said at the time that no funds had been stolen.

Binance confirmed the attack, and blockchain analytics firms Chainalysis and TRM Labs put the theft at approximately $6.4 billion — more than four times the previous record, the $1.5 billion hack of Bybit in February 2025. It is the largest crypto theft on record.

The market's response has been measured by comparison. Bitcoin is down about 4% a day after the breach, and more than $1.3 billion in leveraged positions was liquidated — trades placed with borrowed money that exchanges close automatically when prices move against them. Even so, the asset is holding relatively steady, all things considered.

A Different Market Than 2018

The 2018 incident was a phishing and theft attempt rather than a direct hit on exchange reserves. Attackers took over user accounts, created API keys — credentials that allow trading bots to act on an account — and used them to pump the then-obscure coin Viacoin, while 31 accounts that had pre-deposited the coin sold into the artificial rally. Bitcoin fell from $10,740 to $9,690 within minutes and kept sliding to about $6,600 by April 5, though the market was already deep in a bear run after peaking near $20,000 in December 2017.

The difference in scale is stark: the entire crypto market was worth just over $400 billion in March 2018, against roughly $2.6 trillion today.

A major reason panic no longer hits markets the same way is the rise of U.S. spot Bitcoin ETFs. Funds such as BlackRock's iShares Bitcoin Trust let investors gain exposure to Bitcoin through an ordinary brokerage account, and they now hold roughly 1.3 million BTC, about 6% of total supply. Their shareholders do not keep coins on Binance, and sovereign wealth funds such as Mubadala and the Abu Dhabi Investment Council have been buyers. BlackRock's fund alone took in $136 million on Wednesday, according to Farside Investors data.

These funds do not tend to panic-sell easily, and their holdings remain locked up for long stretches. The theft began at 4:05 p.m. ET on Thursday, after U.S. markets had closed, so Thursday's preliminary $17 million of ETF inflows predate the incident; Friday's flow figures will provide the first real read on whether those holders are selling.

Where the Stolen Funds Stand

The attacker still holds more than 420,000 ETH and 18,270 BTC — roughly $2.4 billion that no stablecoin issuer can freeze. That figure excludes other tokens, which would lift the total above $3 billion. Stablecoin issuers can blacklist addresses and immobilize balances of the tokens they issue, a lever that does not exist for Bitcoin and Ethereum themselves.

TRM Labs and Chainalysis tie the attack to the North Korean group behind the Bybit heist. After that theft, the group converted roughly 84% of the stolen Ethereum into Bitcoin through Thorchain, a cross-chain swap network. That precedent makes the attacker's on-chain footprint the clearest thread to follow in the days ahead.

Binance's Response

Binance says it has set aside more than $6.34 billion of company funds to cover every loss, and it is buying the missing tokens on the open market and over the counter — that is, in private deals off the exchange. About $3 billion of the stolen funds is frozen, deposits are operating normally, and withdrawals are on track to resume in 45 hours.

Sentiment Was Already Soft

Market mood had weakened before the theft and slid further afterward. CoinMarketCap's Fear and Greed index, a 0-to-100 gauge of market sentiment, dropped to 36 from 43, moving into "fear" territory after a "neutral" reading the previous day. Bitcoin sits about 38% below its record high of $126,080.

In 2018, the index stood at just 12 points — deep in "extreme fear" — when the incident occurred. Traders were already in panic mode, and the attack merely compounded an already ugly situation.

Glassnode data show long-term holders are underwater on roughly 4 million coins purchased between $85,000 and $118,000 — every one of them above the current price. HashKey analyst Tim Sun said before the hack that the market's problem "is not panic selling, but rather insufficient new buying interest."

Why Bitcoin Held Up

Taken together, a more optimistic market, far deeper liquidity, active long-term investors, a clearer regulatory framework, the sense of safety that comes with that clarity, swift action by stablecoin providers, and a price trend in recovery all likely played a role in shielding Bitcoin from a global panic despite the record-breaking hack.