Binance said Friday withdrawals remained paused for security work after an incident it estimates had a $6.3 billion impact, while analytics firms estimated $6.36 billion in transfers and $6.43 billion stolen.
The exchange said about $3 billion had been frozen on-chain and pledged to cover all losses with its SAFU fund and company funds. Deposits remained available as it carried out security changes, and Binance expected withdrawals to return within 48 hours.
Binance’s initial review is examining whether a DevOps engineer’s laptop was compromised. The exchange said the device may have provided access to a service container used to send unauthorized withdrawal transactions. It reported no evidence that wallet private keys were exposed and said it would publish technical findings after the investigation, without setting a date.
TRM Labs estimated about $6.36 billion moved from Binance wallets across 10 blockchains, with most transfers occurring within about 20 minutes from 4:05 p.m. ET Oct. 29 (20:05 UTC). Elliptic estimated $6.43 billion was stolen. The firms based their figures on separate blockchain analyses.
Frozen-fund estimates also differed. TRM Labs counted about $2.7 billion frozen by 8:30 p.m. ET Oct. 29 (00:30 UTC Oct. 30); Elliptic said it had verified $2.84 billion by about 3 a.m. ET Oct. 30. Binance’s figure was about $3 billion.
TRM Labs attributed the attack to North Korea’s TraderTraitor group with high confidence, and Elliptic also linked it to North Korea. Elliptic said no government or law enforcement agency had publicly confirmed the attribution; Binance had not publicly named an attacker. The FBI attributed the Feb. 21, 2025, theft of about $1.5 billion in virtual assets from Bybit to North Korea and described the activity as TraderTraitor. Binance plans to publish a technical post-mortem after its investigation and update its Proof of Reserves after remediation, but gave no dates for either.
