Binance hack exposes $6.3‑$6.4 billion breach, yet Bitcoin holds steady
Binance confirmed a record $6.3‑$6.4 billion breach, detailing the theft, market reaction and why Bitcoin didn’t plunge as in 2018.
Binance confirmed that hackers siphoned assets worth roughly $6.3‑$6.4 billion in a single attack, the largest crypto theft on record. Despite the scale, Bitcoin slipped only a few percent and the exchange aims to resume withdrawals within two days. The incident highlights both the growing sophistication of attackers and the market’s evolving resilience.
What happened
On Thursday at 4:05 p.m. ET, after U.S. markets closed, Binance detected an exploit that allowed criminals to erase evidence and bypass internal security checks, according to CEO Richard Teng (CoinDesk). The breach resulted in the loss of more than $6 billion of user assets. Chainalysis and TRM Labs, cited by Decrypt, estimate the theft at $6.4 billion, while Binance’s own statement refers to a $6.3 billion exploit, creating a modest discrepancy between the two outlets.
The attackers walked away with roughly 420,000 ETH and 18,270 BTC—about $2.4 billion in Bitcoin and Ethereum alone. Including other tokens, the total haul exceeds $3 billion. Binance has earmarked over $6.34 billion of its own funds to cover every loss and is buying the missing tokens on the open market and via private over‑the‑counter deals. About $3 billion of the stolen assets are already frozen, deposits remain operational, and the exchange plans to restart withdrawals on Sunday, roughly 45 hours after the breach was discovered.
Bitcoin’s price reaction was muted. Decrypt reports a drop of about 4 % to roughly $76,400, a figure that also translates to a 6 % decline from the level seen after the Federal Reserve’s decision on Wednesday. The market’s fear gauge fell from 43 to 36, moving from “neutral” to “fear” territory, but it stayed far above the “extreme fear” level of 12 that characterized the 2018 incident.
Why it works that way
The attack exploited a combination of insider‑level privilege escalation and gaps in Binance’s monitoring. By erasing logs and sidestepping security checks, the hackers could move funds without triggering the exchange’s automated alarms. This method differs from the 2018 Binance breach, which relied on phishing to hijack user accounts, create API keys (credentials that let trading bots act on an account) and pump a low‑volume coin before dumping it.
The massive size of the theft also reflects the broader market’s growth. The total crypto market cap is now about $2.6 trillion, up from just over $400 billion in March 2018. Larger market depth means that even a multi‑billion‑dollar outflow is a smaller slice of overall liquidity, dampening price impact. Moreover, the rise of U.S. spot Bitcoin ETFs—funds that hold Bitcoin on behalf of investors—means that a sizable portion of BTC (about 1.3 million coins, roughly 6 % of supply) is stored outside exchanges like Binance. These institutional holders are less likely to panic‑sell, providing a stabilising buffer.
Another technical factor is the use of cross‑chain swap networks such as Thorchain, which the North Korean group linked to the Bybit hack used to convert 84 % of stolen Ethereum into Bitcoin. This conversion spreads the shock across assets rather than concentrating it on a single token, further softening any one‑coin price swing.
What changes because of it
Binance’s immediate response—freezing half of the stolen assets, allocating billions to reimburse users, and promising proof of reserves on Monday—signals a shift toward greater transparency after past criticism. The exchange’s plan to publish proof of reserves could set a new industry benchmark, forcing other platforms to disclose the exact backing of user deposits.
For traders, the episode underscores the lingering risk of leveraged positions. More than $1.3 billion in leveraged bets were liquidated as prices moved, showing how quickly margin calls can cascade in a volatile market. Yet the overall market sentiment remained relatively calm, suggesting that the growing presence of long‑term institutional investors, such as BlackRock’s iShares Bitcoin Trust, is tempering panic.
Looking ahead, the key question is whether regulators will tighten custody standards for large exchanges. The fact that the attackers still hold billions in unfreezable tokens points to a structural vulnerability: once crypto leaves the exchange, traditional legal tools have limited reach. Investors may therefore favour custodial solutions that lock assets for longer periods, as seen with the ETF inflows that continued even after the breach.
In practice, this usually means that everyday holders on Binance will see their balances restored, but the incident will likely push the community to scrutinise exchange security more closely and demand clearer audit trails. Those watching the market for macro signals should monitor ETF flow data and any regulatory proposals that target exchange custody practices, as they will shape how future hacks translate into price movements.
