Binance estimates that a security incident involving unauthorized withdrawal transactions had an impact of about $6.3 billion. Its latest update says deposits are operating normally, while withdrawals remain paused. Binance expects withdrawals to resume within 48 hours, but that is an estimate, not a confirmed reopening time.
What does the $6.3 billion figure mean?
Binance describes $6.3 billion as its estimated total impact. TRM Labs separately says its analysis traced about $6.36 billion in transfers from Binance-attributed wallets across ten blockchains on October 29. TRM valued those transfers at the price of the assets when they moved. The figures come from different measurements and should not be treated as the same calculation.
How much has been frozen?
Binance said roughly $3 billion in affected assets had been frozen. In an on-chain snapshot through 00:30 UTC on October 30, TRM estimated that about $2.7 billion had been frozen and about $2.4 billion remained with the attacker. These are approximate, time-sensitive figures from separate sources. Binance also said it would cover losses.
Who does TRM suspect?
TRM attributes the attack to TraderTraitor, a North Korea-linked hacking group, and says it has high confidence in that assessment. Binance has not confirmed who was responsible. It says it is working with law-enforcement partners to identify the perpetrators. TRM describes the incident as the largest cryptocurrency theft on record, a ranking based on its analysis.
Does Binance know how the incident happened?
Binance’s initial investigation suggested that a compromised DevOps engineer’s laptop may have allowed an attacker to access a service container and submit unauthorized withdrawals. Binance later said it had found additional breach points and was tracing the full attack path. A final technical explanation has not yet been published.
Binance’s incident update and latest service update provide the company’s account. TRM’s analysis provides its on-chain estimates and attribution.
