Binance hack causes smaller DeFi run than $292M Kelp exploit

The $6.36 billion Binance hack has caused a smaller and shorter withdrawal wave across DeFi lending markets than April’s $292 million Kelp DAO exploit, according to findings shared by Sentora.

According to insights Sentora shared with crypto.news, lending protocols recorded $1.59 billion in net outflows in one day after the Binance breach, equivalent to roughly 3% of lending total value locked.

Around 60% of those funds returned within three days, and Sentora found no bad debt across the lending markets it assessed.

Binance losses stayed outside lending collateral

After Kelp’s exploit, the firm measured $10.9 billion leaving lending protocols over five days, or approximately 21% of lending TVL. None returned within that observation window, despite the initial theft being less than 5% of the Binance loss.

Sentora attributed the different reactions to where the damaged assets sat. Binance’s loss remained at the exchange, while Kelp’s compromised asset served as collateral across lending markets, leaving depositors uncertain about which pools faced exposure.

The Kelp withdrawals amounted to around 37 times the stolen sum, based on Sentora’s figures. Its comparison uses different observation windows: one day for Binance’s initial outflow and five days for Kelp.

In its earlier incident report, Sentora said its two main Morpho vaults met every redemption despite withdrawals of 11% to 13% within six hours. Its markets recorded one liquidation worth roughly $35,000, with no bad debt or losses on positions it supervised.

Stablecoin issuers froze funds before further transfers

In its Nov. 6 digest, Sentora described the Binance response as the largest coordinated on-chain asset freeze in DeFi history. Circle blocked 823 million USDC in one wallet before the attacker could move it onward.

The report assigned separate interventions to Ripple, which froze roughly $40 million in RLUSD, and World Liberty Financial, which immobilized $27 million in USD1 and 48 million WLFI tokens.

Native Bitcoin and Ethereum have no stablecoin issuer able to impose the same blacklist. Sentora identified 18,270 BTC and more than 420,000 ETH among the attacker’s holdings following containment.

Binance’s Nov. 3 account traced the intrusion through fake recruitment interviews, malicious software, and an internal AI tool. As previously reported by crypto.news, attackers reached the signing service through compromised employee systems.

On the U.S. enforcement side, the FBI’s Oct. 31 alert attributed the theft to North Korea’s TraderTraitor activity. Working with the Secret Service and IRS Criminal Investigation, it urged cryptocurrency services to block transactions involving the published attacker addresses.

Converted Bitcoin holdings reach $124 million

Elliptic’s Nov. 6 update put Bitcoin converted from other stolen assets at approximately 1,650 BTC, worth $124 million, almost twice the previous day’s figure. Most of the overnight growth came from XRP swapped through THORChain.

By 08:45 UTC, around 42 million XRP worth $50 million had left the holding addresses, while 192 million XRP worth $226 million remained, according to the blockchain intelligence firm.

The original 18,270 BTC remained untouched across 19 addresses. Elliptic counted more than 20,000 wallets and at least 65,000 transactions across 16 blockchains in the laundering operation, with $3.11 billion still in theft-linked addresses and negligible suspected cash-out.

Privacy Cash temporarily paused deposits on Nov. 4 after theft-linked inflows, while keeping withdrawals open. Elliptic said its Solana deposits resumed the following afternoon and identified no further hacker-linked deposits after reopening.

Frozen Arbitrum funds require a governance vote

Binance requested the return of 8,425.997 ETH and 74,559,805.2 ARB on Nov. 5, according to its proposal to Arbitrum’s DAO.

The exchange expects roughly 49 days for discussion, voting, and execution, potentially longer if legal claims intervene. Its proposal would prevent submission and delivery while an effective legal order bars the transfer, unless a court permits it.

Binance’s proposed indemnification agreements would apply New York law and assign disputes to state and federal courts in New York County. No new DAO treasury allocation is requested.

Separately, Binance said in its Nov. 4 recovery update that it had replaced approximately 98% of affected assets using company resources. The outstanding 2% involved less liquid tokens being purchased through market and over-the-counter channels.

“We have already set aside more than 100% of the funds needed to cover these losses,” the exchange said.