Institutional crypto investors rush to pull funds from exchanges after Binance hack

Binance's $6.34 billion loss is the largest exchange hack on record, eclipsing Bybit's $1.5 billion breach earlier in 2025 and surpassing the Mt. Gox collapse of 2014 as a reference point for industry risk. Investigators at TRM Labs and Chainalysis attribute the intrusion to North Korea's TraderTraitor group, the same actors linked to Bybit, continuing a pattern of state-backed operators using fake recruiters and tampered software to reach exchange engineers rather than breaking cryptographic systems directly.

Institutional depositors moved quickly once withdrawals reopened, pulling roughly $3.64 billion in net outflows, equal to 2.1% of Binance's reported $171 billion in assets, with volumes easing after the initial spike. Large holders now demand proof-of-reserves transparency and multi-exchange custody splits rather than concentrated balances on one platform. Smaller retail users face longer waits as less liquid tokens remain frozen, while rival exchanges use the episode to market their own wallet-signing safeguards.

Tether's freeze of more than $1.5 billion in USDT within 30 minutes of the theft shows how centralized stablecoin issuers can act as a last line of defense against state-linked theft, cutting off funds the US says support North Korea's weapons programs. That same power sits awkwardly against crypto's founding promise of censorship-resistant, permissionless value transfer: the faster issuers can freeze, the more a 'decentralized' asset depends on a handful of companies holding override keys.

Binance has reopened all 15 initial crypto network groups and restored USD withdrawals, but several tokens remain suspended, and the exchange's own published breach timeline, running from a June software compromise to a September fake-interview access point, still leaves open how two engineers were separately targeted. The next marker is whether Binance completes withdrawals for the remaining suspended assets and whether its promised fuller security audit identifies further compromised systems.

BitcoinBTC it is the asset of the company or protocol in the event

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.