Binance Loses $3.64 Billion to a Bank Run While the Firm Tracking Its Hackers Gets Hacked Too

Binance spent the weekend finding out what happens when customers stop trusting an exchange with their coins. After reopening withdrawals on November 1 following the October 29 theft of roughly $6.3 billion, the exchange watched $4.65 billion leave in withdrawals against $1.01 billion in deposits, a net outflow of about $3.64 billion in a single stretch of trading. In the same week, Chainalysis, the blockchain analytics firm whose job is to trace exactly this kind of theft, disclosed that it had been breached too.

THE BANK RUN BY THE NUMBERS

Binance says the $3.64 billion net outflow represents about 2.1 percent of the $171 billion in total assets it reported in its October 28 proof of reserves. That framing is Binance's own, and it is the same framing every bank facing a run reaches for: the number is scary until you divide it by something bigger. A new proof of reserves snapshot is due to replace the October 28 figures, and until it posts, 2.1 percent is the only yardstick anyone has.

The theft itself has already been confirmed as the largest in cryptocurrency history. The FBI said on October 31 that North Korea was responsible, attributing the attack to a hacking unit it tracks as TraderTraitor, part of the broader Lazarus Group. Blockchain analytics firms TRM Labs and Chainalysis had already reached the same conclusion days earlier. North Korea has denied involvement, which is also what North Korea said about the $1.5 billion Bybit theft in 2025 that the same hacking unit was later blamed for.

THE CRIME TRACKER BECOMES THE CRIME SCENE

Chainalysis confirmed that an outside attacker used what it called offensive agentic techniques to get into its own systems and internal tools. The data taken included customer user IDs, full names, email addresses and organizational role labels. Chainalysis says there is no evidence the intrusion touched investigation content such as case files and graphs, transaction or query results, passwords, MFA secrets or session tokens, and it says the incident is unrelated to the Binance theft it has spent the past week tracing.

Whether or not the two incidents are connected, the exposure itself has teeth. Chainalysis's customer roster includes the investigators, exchanges and government agencies currently chasing more than $6 billion in stolen funds across ten blockchains. Names, emails and job titles are exactly the raw material an attacker needs to run a convincing phishing campaign against the people doing the chasing.

WASHINGTON MOVED FASTER THAN USUAL

The FBI's attribution came two days after the theft, an unusually fast turnaround for an agency that has historically taken weeks or months to name a culprit in cases like this. The Secret Service said separately that its investigators worked with industry partners within minutes of the attack to identify and freeze a portion of the stolen funds, and stablecoin issuers moved just as quickly: Tether froze about $1.57 billion in USDT and Circle froze more than $800 million in USDC tied to the theft.

Binance founder Changpeng Zhao, who no longer runs the exchange day to day after pleading guilty in 2023 to failing to prevent money laundering on the platform and being pardoned by President Trump in 2025, thanked the agencies directly on X. "Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets," he wrote. It is a strange thing for a Bitcoin exchange's most visible spokesperson to argue, that a crypto theft needed the traditional financial system's own cops to keep it from bleeding into traditional markets.

ECHOES OF A PATTERN BITCOINERS HAVE SEEN BEFORE

Caitlin Long, the Custodia Bank founder, flagged a different angle on X days before the FBI's attribution landed. She argued the Chainalysis breach looked timed to interfere with the stablecoin freezes, calling the pairing "next-level," and predicted the episode would push US regulators toward building compliance directly into stablecoin smart contracts rather than leaving it to issuers to police after the fact.

Other claims circulating over the weekend did not hold up. A viral post claiming a Binance engineer had been compromised through a romantic relationship with a North Korean operative was traced back to a fabricated summary falsely attributed to blockchain investigator ZachXBT; Binance called it completely false, and neither the FBI's attribution nor Binance co-CEO Richard Teng's own statements support it. Separately, on the show, a host cited an unverified claim attributed to Paxful founder Ray Youssef that Binance has been insolvent for years, a claim that could not be independently confirmed.

What can be confirmed is simpler and less dramatic: an exchange that insists it has the reserves to cover a multibillion dollar theft is still, this week, watching customers pull billions out anyway. CZ is still not Binance's CEO. He just keeps talking like one.

This story comes from the Simply Bitcoin Live show. Watch the full episode.