Binance said it has earmarked more than $6.34 billion to cover losses from its security incident, while blockchain analysis firm TRM Labs tracked $6.36 billion in transfers from wallets it linked to the exchange across 10 blockchains.
Binance said $5 billion was already held in affected tokens, with the remainder being acquired through market and over-the-counter transactions. The exchange said its allocation excludes assets that have been frozen or otherwise secured; those remain subject to recovery and verification.
TRM valued the transferred assets at about $6.23 billion using prices current to its report. The firm said most of the movements took place over roughly 20 minutes on Oct. 29. It called the incident the largest crypto theft on record and estimated the amount was about four times the $1.5 billion Bybit hack in February 2025.
Binance put the incident’s impact at about $6.3 billion and said partners had frozen roughly $3 billion. TRM’s on-chain tally was about $2.7 billion frozen as of Oct. 30 at 00:30 UTC. Binance had said it would cover losses through its Secure Asset Fund for Users and company funds.
Binance’s preliminary review pointed to a potentially compromised laptop belonging to a DevOps engineer. In a later update, the exchange said investigators had identified additional breach points. TRM assessed that the activity suggested a compromise of Binance’s hot-wallet signing infrastructure. Binance has not published final root-cause findings.
TRM attributed the attack to TraderTraitor, which it described as a North Korea-linked hacking unit, with high confidence. Binance said it was working with law enforcement to identify those responsible.
In a service update, Binance said deposits were unaffected while withdrawals were paused. A later update said the exchange expected withdrawals to resume within 45 hours. Binance also plans to publish a technical post-mortem after its investigation and update its Proof of Reserves after remediation.
