What the $6.3 billion Binance hack shows about exchange risk

The Binance hack did not bankrupt the exchange, and Binance says it, not its users, is absorbing the loss. But the ten days after the theft itself showed in unusual detail how exchange risk works in practice: who absorbs a loss, how long access disappears, and which safety nets actually held.

The question

The question is what happens to people who hold assets on a crypto exchange when it is hacked. The Binance case shows it in detail for a large exchange that chose to cover the loss itself.

What the evidence shows

• Binance says the company, not users, absorbed the loss. Binance said it would cover the losses. By November 1 it said it had covered about 95% of the stolen assets, and about 98% by November 4, according to Fortune, using its Secure Asset Fund for Users (SAFU), part of a futures insurance fund, and its corporate treasury, according to CNBC.
• Access, not ownership, was the first casualty. Withdrawals were paused on October 29 and reopened in phases from November 1. Some networks, including INJ, PLASMA, NEAR, and LTC, were still suspended on November 8, Bitcoin.com News reported.
• Issuers froze a large part of the haul. Tether and Circle froze more than $2.3 billion in USDT and USDC within hours. Elliptic later counted $2.85 billion frozen or seized.
• The entry point was inside the company, not the blockchain. Binance first pointed to a compromised engineer's laptop and said it found no evidence of leaked private keys. Its November 3 report described a months-long intrusion that used compromised engineers' computers to reach its internal wallet signing service, SecurityWeek reported.
• Users moved money once they could. Between 06:00 and 15:30 UTC on November 1, Binance processed a net outflow of $3.6 billion, which it put at 2.1% of its assets, TechCrunch reported.

Our analysis

Coverage depends on the balance sheet. Binance could replace billions of dollars because it had the reserves and the corporate funds to do so. That is a property of this exchange at this moment, not a feature of crypto exchanges in general. A smaller platform facing a loss of the same relative size would have far fewer options. On November 2, Brazilian exchange Mercado Bitcoin said no customer funds were lost after a breach in which more than $40 million in suspicious transfers were flagged, Decrypt reported.

Hot wallets concentrate the exposure. Exchanges keep a share of assets online to process withdrawals quickly. The attackers took about $6.3 billion, according to Binance's estimate. The size of the theft shows how much value can sit within reach of the internal systems that control those wallets.

Freezes are a safety net with a condition. Freezing worked because a large part of the stolen value was in stablecoins issued by companies that can block addresses. Bitcoin, ether, and other native tokens have no issuer that can freeze them directly, CNBC noted. There are exceptions: TRM Labs said Arbitrum's Security Council moved 8,426 ETH and 74.6 million ARB, about $30 million, out of an attacker wallet, according to its analysis. The same power that protected Binance's users also means the issuers can block any address.

The cost to users was time. For several days, traders with collateral on Binance could not move it, even as prices fell. Bitcoin fell 4.8% to below $77,000 as the news spread on October 29, CoinDesk reported. When an exchange pauses withdrawals, positions still move in price while the funds stay where they are.

Scenarios

• If Binance's final report is convincing and withdrawals normalize across all networks, the episode is likely to be remembered as a contained, if record, loss.
• If the remaining networks stay closed for long, or outflows persist, pressure on the exchange's liquidity and reputation would grow.
• If a large share of the unfrozen funds reaches markets, the attackers' Bitcoin and ether holdings could add selling pressure; Elliptic said only a negligible amount had likely been cashed out by November 7.

What could prove this wrong

The coverage figures come from Binance itself; Trading Notified has not seen an independent audit of them. A later disclosure that reserves were weaker than stated, or that the breach went deeper than Binance's November 3 report describes, would change the assessment.

What to watch

• Binance's final post-mortem (an initial report came on November 3) and the findings of the independent security firms it says it has engaged.
• Reserve figures and daily net flows.
• Which networks remain suspended.
• What happens to the $2.85 billion frozen or seized, and to the rest of the stolen funds.