#FOMC会议 Withdrawals have been suspended for the assets stolen from Binance. He Yi says users’ funds are still safe, but I’m a little uneasy, so I looked into how Binance has handled thefts over the years...
Binance has been around for more than nine years. Before today, the only time money was stolen from the exchange’s own wallet was in 2019: $40 million. If reports about this morning’s incident are confirmed, the estimated outflow alone is $3.3 billion—more than 80 times as much.
So I went through all of Binance’s past incidents to see how each one was resolved.
The first was in March 2018.
The hackers spent months setting up phishing websites, collecting user accounts, and creating API keys for trading on each account. On March 7, those accounts were manipulated into buying VIA over the course of two minutes, driving its price up 100-fold. The hackers sold VIA through 31 accounts they had set up in advance. But when they tried to withdraw the funds, Binance’s risk controls kicked in, halting all trading and withdrawals. Binance reversed all the abnormal trades from those two minutes and seized the VIA the hackers had deposited. In the end, they got away with nothing. Binance later offered a $250,000 bounty and set aside another $10 million for future hacker bounties.
Strictly speaking, the incident that July wasn’t a theft. Several API accounts made abnormal trades, and SYS, which normally traded for a few cents, sold for 96 BTC on Binance.
Binance halted trading for about half a day, reversed the abnormal trades, and deleted and reissued everyone’s API keys. SAFU was also created after this incident: 10% of trading fees was set aside in a cold wallet to cover users’ losses.
The May 7, 2019 incident was a real theft.
Hackers used phishing and malware to obtain a batch of users’ API keys and Google Authenticator codes. Then a single transaction withdrew 7,074 BTC from a BTC hot wallet, worth about $40 million at the time. That hot wallet held only 2% of Binance’s BTC. Binance said that same day that SAFU would cover the full amount, so users wouldn’t lose anything. It then suspended deposits and withdrawals for a week while it updated its APIs, two-factor authentication, and withdrawal reviews.
There was another twist in the middle of all this. CZ briefly said he was considering asking miners to roll back the Bitcoin blockchain and reverse the transfer, and he was heavily criticized for it. The next day, he said he wouldn’t do it and apologized, explaining that it would set a very bad precedent for Bitcoin.
In August that year, there was an extortion attempt.
Someone had 10,000 photos of KYC documents allegedly belonging to Binance users and demanded 300 BTC to keep them quiet. Binance refused, saying the photos had leaked during an outsourced verification process in 2018. It also offered a 25 BTC bounty to identify the person.
The incident in October 2022 involved the BNB Chain.
Hackers forged cross-chain bridge verifications and minted 2 million BNB out of thin air, worth about $570 million at the time. Binance asked the validator nodes to halt the entire chain for about eight hours. The hackers only had time to move a little over $100 million; the remaining $400 million-plus was stuck on-chain and couldn’t be moved. The BNB Chain later hard-forked to fix the bridge, but the fact that a public blockchain could simply be halted drew heavy criticism at the time.
Around Christmas 2025, the incident involved Binance-owned Trust Wallet.
Malicious code was inserted into version 2.68 of the browser extension, and more than 2,500 wallets were drained of about $7 million. CZ said users would be fully reimbursed, and the claims process opened two days later.
Looking back, you can see Binance’s usual approach.
When something happens, they halt things first; they reverse transactions if they can, and if they can’t, they pay out of pocket to make up the difference. So far, users haven’t had to bear any financial losses. SAFU covered the $40 million loss in 2019 straight away.
Today’s incident is on a completely different scale.
Estimates of the outflow range from $3.3 billion to more than $5.5 billion. Tether froze more than $1.5 billion in USDT, and Circle froze more than $800 million in USDC, for a total of over $2.3 billion. Most of what couldn’t be frozen was ETH: there are 195,000 ETH at the receiving addresses alone, worth more than $400 million.
The official statement still hasn’t said there was a hack; it only says users’ funds are completely safe. CZ said it does look like a hack and that, as a shareholder, he expects users to be fully covered. There are also reports that He Yi has confirmed withdrawals are suspended.
In February this year, SAFU was converted entirely into BTC—about 15,000 BTC, worth $1 billion at the time. There may still be a chance to recover the frozen stablecoins; the real hole depends on how much of the funds couldn’t be frozen. If it exceeds SAFU, Binance will have to use its own money.
I think Binance can afford to reimburse users, and users probably won’t lose anything this time either. What I’m more concerned about is who signed the 7702 authorization for the hot wallet. Unless they explain that clearly, even if withdrawals resume, people still won’t feel comfortable. $BNB
