Fundstrat says investors users with crypto holdings on Binance should re-evaluate
Bitcoin and related stocks tumbled Friday after a record hack of the cryptocurrency platform Binance.
Binance vowed to resume withdrawals within two days after the crypto exchange suffered a $6.3 billion heist that analysts say is the biggest ever.
"We are still on track toward the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected," Binance said on an X post on Friday.
"Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach," it said. "This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them."
Binance founder and biggest shareholder Changpeng Zhao, who no longer manages the company, declared on X that users' funds were safe, which was echoed by the exchange. Losses will be covered by the Secure Asset Fund for Users, a reserve fund of around $1 billion used in cases of extreme breaches, and the company's funds.
"The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far," it said.
News of the hack rattled crypto markets, with bitcoin (BTCUSD) sliding 3.5% to $77,901, a level not seen since mid-September. Ethereum (ETCUSD) fell 1.6% to $2,221.49, near levels not seen since mid-August.
Cybersecurity research firms TRM Labs blamed the theft on TraderTraitor, North Korea's elite hacking unit, "based on robust on and off-chain intelligence."
"The FBI named the same group as responsible for the $1.5 billion Bybit hack in February 2025. Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst," TRM said.
Tornado Cash, which was developed on the Ethereum chain, allows a user to deposit different cryptocurrencies into a shared pool. The user gets a transaction key that can be used to withdraw the crypto into a different wallet.
Sean Farrell, head of digital asset strategy at Fundstrat, said blockchain data showed around $6.3 billion was drained from Binance wallets across eight chains on Thursday, with $6.1 billion of taken in the first 55 minutes. The hack is now the biggest on record, he said.
"The most important takeaway for markets is that this does not currently appear to create meaningful solvency risk for Binance. Assuming frozen stablecoins are ultimately returned, the hole is [approximately] $3.3 billion," Farrell told clients in a note.
"The real systemic concern would be a shortfall in customer assets that forces Binance to liquidate reserves, accelerates withdrawals, causes counterparties to pull credit, and creates a reflexive deleveraging cycle across crypto. I do not think that is the setup we are dealing with, but the key tell will be how quickly withdrawals resume and whether outflows stay orderly," he said.
The onus is now on exchanges to prove customers funds are secure. "Until there is greater clarity around how this compromise occurred, I think it is reasonable for users with funds on Binance to reassess how much capital they need to keep on the venue vs. what can be held elsewhere," he said.
Across related stocks, Strategy (MSTR), Circle Internet Group (CRCL) and Coinbase (COIN) all fell over 4%, while shares of Robinhood (HOOD) slid over 5%.
Brian Armstrong, co-founder and CEO of Coinbase (COIN), said on X that the exchange was blocking compromised wallets and urged the industry to work together over the hack. "Crypto has been through many tough times, and has always come out stronger on the other side. This won't be any different."
-Barbara Kollmeyer
Comments