Binance hack triggers smaller DeFi run than $292M Kelp exploit: Sentora

The $6.36 billion Binance hack has caused a smaller and shorter withdrawal wave across DeFi lending markets than April’s $292 million Kelp DAO exploit, according to findings shared by Sentora. Summary $1.59 billion left lending markets after Binance’s breach, with 60% returning within three days. Kelp’s smaller exploit prompted $10.9 billion in withdrawals over five days, according to Sentora. Circle froze 823 million USDC before the attacker could move the tokens onward. Investigators have traced $124 million converted from other stolen assets into Bitcoin. According to insights Sentora shared with crypto.news, lending protocols recorded $1.59 billion in net outflows in one day after the Binance breach, equivalent to roughly 3% of lending total value locked. Around 60% of those funds returned within three days, and Sentora found no bad debt across the lending markets it assessed. Binance losses stayed outside lending collateral After Kelp’s exploit, the firm measured $10.9 billion leaving lending protocols over five days, or approximately 21% of lending TVL. None returned within that observation window, despite the initial theft being less than 5% of the Binance loss. Sentora attributed the different reactions to where the damaged assets sat. Binance’s loss remained at the exchange, while Kelp’s compromised asset served as collateral across lending markets, leaving depositors uncertain about which pools faced exposure. You might also like: Vitalik Buterin warns crypto exchanges must focus on survival after Binance hack The Kelp withdrawals amounted to around 37 times the stolen sum, based on Sentora’s figures. Its comparison uses different observation windows: one day for Binance’s initial outflow and five days for Kelp. In its earlier incident report, Sentora said its two main Morpho vaults met every redemption despite withdrawals of 11% to 13% within six hours. Its markets recorded one liquidation worth roughly $35,000, with no bad debt or losses on positions it supervised. Stablecoin issuers froze funds before further transfers In its Nov. 6 digest, Sentora described the Binance response as the largest coordinated on-chain asset freeze in DeFi history. Circle blocked 823 million USDC in one wallet before the attacker could move it onward. The report assigned separate interventions to Ripple, which froze roughly $40 million in RLUSD, and World Liberty Financial, which immobilized $27 million in USD1 and 48 million WLFI tokens. Native Bitcoin and Ethereum have no stablecoin issuer able to impose the same blacklist. Sentora identified 18,270 BTC and more than 420,000 ETH among the attacker’s holdings following containment. Binance’s Nov. 3 account traced the intrusion through fake recruitment interviews, malicious software, and an internal AI tool. As previously reported by crypto.news, attackers reached the signing service through compromised employee systems. On the U.S. enforcement side, the FBI’s Oct. 31 alert attributed the theft to North Korea’s TraderTraitor activity.