Binance Founder CZ: Withdrawals Should Be Suspended First in Case of Incidents

Binance founder Changpeng Zhao's public principle is that exchanges should first suspend withdrawals after a security incident, investigate how hackers gained access, identify which devices were compromised, and confirm safety before resuming operations. After the Bybit hack, he wrote: "The situation is difficult to handle; as a standard precaution, it may be best to suspend all withdrawals first; $1.5 billion is already enough to cause panic, so it’s better to err on the side of safety." He added that there is no absolute right or wrong, just a direction based on experience that leans towards safety.

On February 21, 2025, approximately $1.5 billion was drained from a cold wallet at Bybit, marking one of the largest single thefts on record in the industry. The assets included about 401,300 ETH and staking derivatives like stETH, cmETH, and mETH, with on-chain analysis pointing to North Korea's Lazarus group. The attack occurred during what was supposed to be a routine internal transfer: the front end displayed a normal transaction, but a different transaction was actually signed, and the cold wallet used Safe multi-signature. CEO Ben Zhou assessed that the internal system and hot wallet were not compromised, chose to continue withdrawals, and stated that even if losses could not be recovered, the platform still had the ability to pay.

With the withdrawal channel still open, a bank run ensued. CoinDesk reported that the theft combined with the "bank run" caused the platform's related wallet assets to drop from about $16.9 billion to approximately $11.2 billion, totaling over $5.5 billion in outflows; another statistic tracked assets dropping from nearly $17 billion to about $10.8 billion within three days. Zhou stated that within ten hours, the platform experienced the highest number of withdrawal requests ever, exceeding 350,000, prioritizing retail users and imposing tiered restrictions on institutions, while also borrowing Ethereum liquidity from peers. He later said that if the withdrawal system or hot wallet had been compromised, he would agree to suspend withdrawals; this time it was a cold wallet, and the remaining internal parts were confirmed safe by a security company before he dared to keep operations running. CZ's suggestion was seen about half an hour later while he was live streaming.

CZ categorized this incident into the same pattern: Bybit, Phemex, WazirX, and others have all experienced significant withdrawals from multi-signature "cold storage." On May 7, 2019, Binance's hot wallet was drained of 7,000 BTC, worth about $40 million at the time, with hackers obtaining a large number of user API keys and two-factor codes, allowing them to bypass pre-withdrawal risk controls, which were later blocked by post-monitoring. Binance immediately suspended deposits and withdrawals while trading continued, using the SAFU user security fund to fully cover losses, and resumed operations about a week later after a comprehensive security audit; CZ later stated that net inflows exceeded net outflows upon reopening. He emphasized that at the time, it was not 100% certain whether it was a hacker, a malfunction, or user operation, so they initially labeled the withdrawal server as undergoing unscheduled maintenance.

The industry's division of labor unfolded simultaneously during the incident. ZachXBT tracked the stolen ETH split into dozens of addresses, while Tether, Circle, and others assisted in freezing some outflows; Bybit later stated that it had recovered and frozen approximately $78.9 million in total and filed lawsuits against North Korea and Lazarus. The absence of a publicly confirmed second wave of attacks on Bybit's hot path does not mean the entry point has been clarified. CZ wrote "suspending operations for a week to conduct checks" into his operational manual, while Ben's judgment was to "not suspend operations to withstand the bank run"; both manuals are competing for the same issue: whether the withdrawal button is a risk control switch or a credibility switch.

In market mechanisms, buyers are users wanting to immediately retrieve their coins and market makers wanting to see proof of solvency; sellers are exchanges that must prove their hot wallets are still intact amid panic. The event was driven by a fake interface tricking signatures from the cold wallet. Funds surged from user balances to on-chain autonomous addresses, then flowed back into the withdrawal queue through peer borrowing. Those benefiting are platforms that can use SAFU or reserves to withstand net redemptions and frame suspensions as professional actions; those under pressure are platforms that choose not to suspend operations and trade liquidity for time, as well as all custodians treating multi-signature cold wallets as "isolated." Regulators have yet to codify "withdrawals must be suspended after a theft" into a unified rule, and pricing power still lies in the founders' immediate statements.

Source: Public Information