Binance’s $6.4 Billion Hack Tests a Larger Crypto Market

By Nathan Brooks

Binance confirmed a Thursday cyberattack that Chainalysis and TRM Labs valued at roughly $6.4 billion, more than four times the $1.5 billion stolen in the February 2025 Bybit heist. Bitcoin dipped to about $76,400 on Friday, roughly 6% below its post-Federal Reserve level, and traded down about 4% for the day.

The theft began at 4:05 p.m. ET Thursday, after U.S. markets closed. Exchanges liquidated more than $1.3 billion in leveraged positions by automatically closing trades funded with borrowed money when prices moved against traders.

What does this change for traders and depositors?

The exchange’s response changes access and liquidity in four specific ways:

• Loss coverage: Binance has set aside more than $6.34 billion of company funds to cover every loss.
• Inventory replacement: The exchange is buying missing tokens on the open market and over the counter, where private deals occur away from the exchange.
• Asset freezes: Binance says about $3 billion in assets has been frozen.
• Customer access: Deposits are operating normally, and withdrawals are on track to resume within 45 hours.

For depositors, the immediate operational constraint is the 45-hour timetable for withdrawals. For traders, Binance is replacing missing inventory through open-market and private OTC purchases while company funds absorb the loss.

The freeze does not extend to the attacker’s native holdings. The attacker still controls more than 420,000 ETH and 18,270 BTC, valued at about $2.4 billion, and no stablecoin issuer can freeze either asset. The estimate excludes other tokens; including them would lift the holdings above $3 billion.

TRM and Chainalysis tie the attack to the North Korean group behind the February 2025 Bybit theft. After Bybit, that group converted about 84% of the stolen Ethereum into Bitcoin through Thorchain, a cross-chain swap network.

During the March 2018 attack attempt, attackers used phishing to take over accounts and created API keys, credentials that let trading bots act on an account. They used that access to pump the obscure coin Viacoin while 31 accounts that had pre-deposited the coin sold it; Binance said the attempt stole no funds.

Bitcoin fell from $10,740 to $9,690 within minutes and continued to about $6,600 by April 5. The market was already in a bear run after peaking near $20,000 in December 2017.

The total crypto market now stands at roughly $2.6 trillion, compared with just over $400 billion in March 2018. That expansion has created deeper liquidity and brought more capital into investment vehicles with different custody arrangements.

U.S. spot Bitcoin ETFs hold roughly 1.3 million BTC, about 6% of Bitcoin’s supply. Products such as BlackRock’s iShares Bitcoin Trust let investors buy Bitcoin through ordinary brokerage accounts, and ETF shareholders do not keep coins on Binance.

Mubadala and the Abu Dhabi Investment Council have also been buying, while BlackRock’s fund took in $136 million on Wednesday, according to Farside Investors. Those allocations generally remain committed for long periods and do not tend to panic sell.

The attack’s timing makes Friday’s ETF flow figures the first real read on whether holders are selling. Thursday’s preliminary $17 million in inflows predated the 4:05 p.m. ET theft, so the earlier figure cannot capture post-attack behavior.

Sentiment was already soft before the theft. CoinMarketCap’s 0-to-100 Fear and Greed Index fell to 36 from 43, moving from neutral to fear. Bitcoin trades about 38% below its $126,080 record; in 2018, the gauge registered 12 in extreme fear before the attack worsened an already stressed market.

Glassnode data show about 4 million coins held by long-term investors bought between $85,000 and $118,000 remain underwater. Before the hack, HashKey analyst Tim Sun said the market’s problem “is not panic selling, but rather insufficient new buying interest.”

The market’s relative stability after a record theft rests on a larger liquidity base, more institutional and active long-term participation, the perceived safety of greater regulatory clarity, quick action by stablecoin providers and a recovery trend. Those buffers do not remove custody or execution risk; they change how quickly losses can be frozen, funded and absorbed.

The next checkpoints are Binance’s 45-hour withdrawal restart and Friday’s ETF flow data, which will test whether the deeper, ETF-backed market structure can absorb the theft without reproducing the 2018 panic.