Binance hack sparked smaller DeFi withdrawal wave than Kelp exploit

Sentora’s figures show lending outflows after the Binance breach amounted to roughly 3% of the markets’ total value locked, and the firm found no bad debt among the markets it assessed. By comparison, Kelp’s exploit was followed by $10.9 billion leaving lending protocols over five days—about 21% of lending TVL. None of those funds returned during that observation period, even though the initial theft was less than 5% of Binance’s loss.

Sentora linked the difference to how the stolen assets were used. Binance’s loss remained at the exchange, while Kelp’s compromised asset had been used as collateral across lending markets, leaving depositors unsure which pools were exposed. The Kelp withdrawals were about 37 times the stolen sum, according to Sentora; the comparison uses one day of data for Binance and five days for Kelp. In an earlier report, Sentora said its two main Morpho vaults met all redemptions after withdrawals of 11% to 13% in six hours. The markets it supervised recorded one liquidation of roughly $35,000, with no bad debt or losses on supervised positions.

Sentora described the response to the Binance hack in its Nov. 6 digest as the largest coordinated on-chain asset freeze in DeFi history. Circle froze 823 million USDC in one wallet before the attacker could move the tokens. Ripple froze roughly $40 million in RLUSD, while World Liberty Financial immobilized $27 million in USD1 and 48 million WLFI tokens. Sentora identified 18,270 BTC and more than 420,000 ETH among the attacker’s holdings after the freeze. Unlike stablecoins, native Bitcoin and Ethereum have no issuer able to blacklist assets.

Binance said on Nov. 3 that the intrusion began with fake recruitment interviews, malicious software and an internal AI tool; attackers reached the signing service through compromised employee systems. The FBI’s Oct. 31 alert attributed the theft to North Korea’s TraderTraitor activity and urged crypto services to block transactions involving the published addresses. Elliptic said on Nov. 6 that about 1,650 BTC, worth $124 million, had been converted from other stolen assets, nearly twice the previous day’s total. Most of the overnight increase came from XRP swapped through THORChain. By 08:45 UTC, about 42 million XRP worth $50 million had left holding addresses, while 192 million XRP worth $226 million remained.