Cryptocurrency scammers are exploiting the chaos surrounding a record-breaking theft at Binance, targeting customers attempting to recover their funds as the exchange works to restore normal operations. The platform suffered a $6.3bn breach on Thursday, described as the largest cryptocurrency heist in history, prompting a wave of fraudulent schemes designed to deceive affected users.
According to The Guardian, Binance initially suspended withdrawals while investigating the incident but resumed operations on Sunday. By Sunday afternoon, the platform had processed $4.6bn in customer withdrawals alongside $1bn in deposits, resulting in a net outflow of approximately $3.6bn—representing 2.1% of its $171bn in total assets under management. The company confirmed these figures through its latest proof of reserves snapshot, with a comprehensive report expected to follow.
Changpeng Zhao, founder of Binance and commonly referred to as CZ, publicly warned that fraudsters are now actively targeting individuals seeking to withdraw their money from the platform. In a post on X, he cautioned:
Scammers on over drive now. Be careful.
His warning came in response to Binance's own alert regarding fabricated screenshots circulating online. The exchange stated:
Some of you may have seen posts and screenshots circulating recently. Please be aware that these screenshots are fake and the information in them is false. For accurate and up-to-date information, always refer to our official channels and announcements.
What compensation scams are targeting Binance customers?
Fraudsters are distributing digitally altered screenshots that falsely promise $150 in complimentary compensation for withdrawal suspensions. Binance has explicitly confirmed that these claims are fabricated and the images have been manipulated. The scammers are capitalizing on the uncertainty and concern among customers affected by the theft, attempting to trick them into revealing personal information or transferring funds to fraudulent accounts.
How is the broader crypto market reacting?
The hack has triggered significant market anxiety, with investors withdrawing substantial sums from Bitcoin exchange-traded funds in the United States. Nick Forster, chief executive of Derive.xyz, a cryptocurrency trading platform, reported that US spot Bitcoin ETFs experienced $643 million in net outflows on Friday, their first trading session following the breach. BlackRock's IBIT fund saw $233.7 million in outflows, while Fidelity's FBTC lost $201 million, ARKB declined by $129.5 million, GBTC fell $53.3 million, and BITB dropped $25.7 million. Notably, no fund recorded net inflows during this period.
Options trading patterns reveal heightened defensive positioning among market participants. Forster noted that put options—which protect against price declines—accounted for 68% of Bitcoin options premiums traded in the first 12 hours following the hack, compared with 43% in the preceding five days. Trading activity surged to approximately $55 million in daily Bitcoin options volume since the breach, up from $34 million the day before, as traders moved quickly to hedge against further losses.
Market sentiment regarding Bitcoin's price trajectory has deteriorated sharply. Forster stated:
Last Wednesday, Derive options were pricing a 6% probability of Bitcoin exceeding $100K by Christmas. That has now fallen to just 3.5%, or roughly a one-in-30 chance.He added that before the hack, options markets had priced a 75% probability of Bitcoin finishing above $80,000 at Friday's expiry, but Bitcoin instead settled at $77,786.
What do authorities know about the attackers?
The FBI identified North Korean state-backed actors as responsible for the theft, according to reporting on the incident. The FBI observed the attackers converting stolen assets primarily into Ethereum and urged crypto firms to block transactions linked to the attackers' addresses.
Binance disclosed that the attack involved a compromised employee laptop and unauthorized withdrawal transactions. The exchange has taken significant steps to mitigate the damage: Binance said about $3 billion in affected assets had been frozen through work with blockchain partners, and the company set aside more than $6.34 billion in its own funds to cover the stolen assets. Independent analysis suggests the theft may have been even larger than initially reported—Chainalysis estimated the haul at roughly $6.4 billion at the time of the theft, compared with Binance's $6.3 billion estimate.
The perpetrators are employing sophisticated money-laundering techniques to obscure the movement of stolen funds. The FBI expects the stolen assets to be further laundered through decentralized-finance and instant-swap services, making recovery efforts increasingly challenging.
How are regulators responding globally?
Financial regulators worldwide are intensifying scrutiny of cryptocurrency exchanges' cybersecurity practices. South Korea's financial regulator convened an emergency meeting on Monday to inspect local exchanges' security measures, ordering immediate implementation of various protective steps. These include constant transaction monitoring, operating response systems to detect and report irregular access attempts, raising the ratio of cold wallets—which secure cryptocurrency private keys offline—and increasing reserve deposits.
In Hong Kong, the Securities and Futures Commission is preparing to strengthen guidance for the crypto industry through new circulars expected in the final two months of the year. Eric Yip, executive director for intermediaries, announced this development at Hong Kong's FinTech week forum.
The Binance incident has also exposed vulnerabilities at other platforms. Rival trading platform Chainalysis disclosed on Friday that it had been targeted by a cyber attack, though it found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens. Chainalysis stated:
Our team is working with leading cybersecurity experts to investigate this activity and harden our systems. We've proactively notified all of our customers and will keep them updated as our work progresses. This security incident is not related to the recent crypto theft at Binance.
What is happening with Binance's service restoration?
Binance has confirmed that customers can now withdraw funds in US dollars as the exchange continues restoring its systems following the theft. Euro, yen, and certain other fiat currency withdrawals were already restored, with the exchange pledging to share further updates as recovery efforts progress.
How are European markets responding?
European stock markets opened lower on the day following the hack announcement. The UK's FTSE 100 index declined 0.3%, with Endeavour Mining and BP among the worst performers, each falling approximately 1.7%. The Stoxx Europe 600, which tracks the continent's largest companies, also fell 0.3%.
Eurozone manufacturing continued to expand in October despite facing significant headwinds from trade tariffs, geopolitical conflicts, and elevated energy costs. According to the latest purchasing managers' index data from S&P Global, the sector's growth pace moderated slightly, with the index declining to 52.7 in October from 52.9 in September—which had marked the highest reading since May 2022. Any reading above 50 indicates expansion.
Chris Williamson, chief business economist at S&P Global Market Intelligence, observed:
Another solid PMI reading extends the eurozone's best growth spell for manufacturing for over four years. The sustained growth recorded since February paints an encouraging picture of resilience for the manufacturing sector, which has been buffeted by the headwinds of tariffs and conflicts in the Middle East and Ukraine, and in particular the surge in costs and supply difficulties that these have caused.
Williamson noted that increased defence spending, precautionary inventory building, diversification, and shifting trade patterns resulting from US tariffs have created expansion opportunities for numerous producers. However, growth remains uneven across the region, with manufacturers in France and Italy facing particular difficulties. France's index fell from 50.6 in September to 49.5 in October, signalling contraction. Williamson added:
Furthermore, with input cost inflation surging sharply higher again in October, climbing to one of the highest rates seen over the past four years thanks to higher energy prices and supply bottlenecks, the latest PMI data add to pressure on the [European Central Bank] to hike rates further in the coming months, providing another headwind to businesses.
French train manufacturer Alstom reported significant losses, with its shares declining 28% to €11.42 following announcements of reduced profit and cash flow forecasts—the company's second downward revision since April. Alstom also unveiled plans to reduce debt by €2bn as it manages delays affecting several major German projects. The company has now surrendered more than half its market value during the year.
What other market movements occurred?
Oil prices retreated following reports that US President Donald Trump intends to allow additional time for diplomatic negotiations with Iran before potentially resuming military strikes after the midterm election. Brent crude, the international benchmark for oil pricing, declined 2.6% to approximately $110 per barrel. According to reporting by Axios, Trump informed Israeli Prime Minister Benjamin Netanyahu of his intention to permit negotiations with Iran to proceed before potentially restarting strikes following the midterm elections on Tuesday.
Key Facts
- Binance processed $4.6bn in withdrawals and $1bn in deposits by Sunday afternoon, resulting in a net outflow of $3.6bn (2.1% of total assets under management)
- Fraudsters are distributing fake screenshots promising $150 in compensation for withdrawal suspensions, which Binance has confirmed are digitally altered
- US spot Bitcoin ETFs experienced $643 million in net outflows on Friday, with no fund recording net inflows
- Put options accounted for 68% of Bitcoin options premiums in the first 12 hours after the hack, compared with 43% previously, reflecting defensive positioning
- The FBI attributed the theft to North Korean state-backed actors, who are converting stolen assets primarily into Ethereum
