Binance said its security incident had an estimated impact of about $6.3 billion and that it would cover all losses with funds from its SAFU reserve and the company. The exchange also reported that about $3 billion in affected assets had been frozen on-chain.
In an update dated Oct. 30, Binance said it had temporarily suspended deposits and withdrawals while security checks were underway. It said it had revoked authorization for the affected address and was working with law enforcement and blockchain intelligence partners to trace and recover the assets. The exchange did not say when deposits or withdrawals would resume.
Binance’s initial investigation suggested the incident may have involved a compromised DevOps engineer’s laptop, which could have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. The company said it had found no evidence of a wallet private-key leak. It has not confirmed a final cause and said it would publish a technical post-mortem after completing its investigation and verifying the facts.
Binance said user funds were safe and that it would publish updated proof of reserves after remediation.
Separately, blockchain analytics firm TRM Labs estimated that about $6.36 billion in assets left Binance-attributed wallets across 10 blockchains on Oct. 29, valuing the transfers at prices when they occurred. TRM said about $2.7 billion had been frozen on-chain by 00:30 UTC on Oct. 30. It estimated that about $2.4 billion remained in assets beyond any issuer’s reach after the attacker converted some funds and borrowed ETH against USDT.
TRM attributed the attack with high confidence to TraderTraitor, a group it identified as North Korean. It also assessed that access to Binance’s hot-wallet signing infrastructure was the most likely explanation for transfers across multiple blockchains. Binance’s update did not confirm either assessment.
Information to support your research. Not personal investment, tax or legal advice. Risk & disclaimer
