Binance is investigating how an attacker moved billions from its hot wallets as outside firms published different loss estimates and the exchange kept withdrawals paused pending security checks.
Binance put the compromise at 4:05 p.m. ET Thursday, Oct. 29 (20:05 UTC). It suspended withdrawals while deposits and unaffected services continued. The exchange said company funds and its Secure Asset Fund for Users would cover the impact. Its co-CEOs said, “Binance will absorb the financial impact of these stolen funds, not our users.”
TRM Labs counted roughly $6.36 billion in transfers over 10 blockchains, with most activity occurring in about 20 minutes. The firm used prices from each transfer and said the same tokens were worth $6.23 billion at 8:30 p.m. ET Oct. 29 (00:30 UTC Oct. 30). Chainalysis separately put the amount at about $5.912 billion at the time of the theft; Binance’s impact estimate was about $6.3 billion.
Binance’s first account pointed to a possible route through a DevOps engineer’s laptop and a service container. In a later update, the exchange said investigators had identified more breach points and were still reconstructing events. Binance also said investigators had not found signs that wallet keys were exposed.
TRM found an EIP-7702 wallet delegation and 50 authorizations signed in advance in the Ethereum activity. Transfers on the other nine networks used standard signed transactions, the firm said. TRM assessed that the attacker may have gained enough access to trigger transaction approval through Binance’s hot-wallet signing systems. Binance has not confirmed that theory or announced a root cause.
TRM linked the attack with high confidence to TraderTraitor, a group tied to North Korea. Chainalysis CEO Jonathan Levin also said the group was likely responsible. The Federal Bureau of Investigation (FBI) attributed the separate $1.5 billion Bybit theft in February 2025 to North Korea and identified TraderTraitor activity in that case; the finding does not establish who attacked Binance.
In its Oct. 30 update, Binance said about $3 billion had been frozen on-chain. TRM’s snapshot at 8:30 p.m. ET Oct. 29 counted $2.7 billion frozen and estimated that $2.4 billion remained beyond any issuer’s reach. A freeze does not mean assets have been returned. Binance said company resources earmarked for the response exceeded $6.34 billion, including $5 billion in affected tokens, and that it was acquiring the remainder through market and over-the-counter trades.
Binance aimed to begin restoring withdrawals in phases within about 34 hours of its Oct. 30 update, subject to security checks. It also planned to share technical findings within about 48 hours and publish updated Proof of Reserves results by Monday, Nov. 2.
