The Binance hack has left the exchange facing an estimated $6.3 billion loss after attackers stole cryptocurrency from its hot wallets on October 29. Binance says it will cover the loss. The exchange has set aside more than $6.34 billion in company funds, reports that around $3 billion has been frozen on-chain, and says withdrawals remain temporarily suspended while security checks continue. Blockchain intelligence firms attribute the attack to North Korea-linked hackers, but Binance has not confirmed who was responsible.
In its second official security incident update, published October 30, Binance said it had already secured more than $5 billion in the same token assets affected by the theft. That represents about 80% of the reported loss. The company says it is buying the remaining assets through market and over-the-counter channels and will use its Secure Asset Fund for Users (SAFU) and corporate treasury to cover the shortfall.
What happened in the Binance hack?
Binance's initial investigation pointed to a potentially compromised laptop belonging to a DevOps engineer. The attacker allegedly used access to a service container to submit unauthorized withdrawal transactions. Binance later said investigators had found additional points of compromise, making the incident more complex than a single-device breach.
The exchange says it has found no evidence that wallet private keys were leaked. It has revoked affected authorizations, contained the compromised infrastructure and added security controls. Binance has not yet published a full technical post-mortem, so the complete entry path and attack sequence remain under investigation.
TRM Labs estimates that approximately $6.36 billion moved from Binance wallets across ten blockchains, with most of the transfers taking place in about 20 minutes. The firm says the attacker used an Ethereum wallet delegation technique involving EIP-7702, alongside signed transfers on other networks. TRM's technical account is an analysis of on-chain activity, not Binance's completed forensic report.
Why researchers suspect North Korea
In its on-chain analysis, TRM Labs attributes the theft with high confidence to TraderTraitor, a North Korean hacking unit. Elliptic has separately assessed that North Korea-linked actors were likely responsible, citing overlaps between addresses connected to this theft and funds associated with an earlier suspected North Korean-linked attack. Both assessments are based on blockchain and other intelligence evidence.
That attribution is not an official finding from Binance or law enforcement. Binance says it is working with law enforcement agencies and blockchain intelligence firms to establish who carried out the attack. The distinction matters: the researchers have named a likely group, but the exchange has not confirmed the identity of the attacker.
The incident adds to a series of major attacks against technology and financial infrastructure. Saganote previously covered an autonomous AI agent attack on Hugging Face, another case in which access to internal systems became a central part of a security investigation.
How much has Binance recovered?
Binance says approximately $3 billion has been frozen on-chain through work with law enforcement, blockchain intelligence firms, asset issuers and industry partners. TRM's latest analysis put the total at about $2.7 billion, while Elliptic said it had verified $2.84 billion in frozen funds. The figures reflect different tracking cutoffs and valuation methods. A freeze prevents assets from moving, but it does not necessarily mean the funds have been returned to Binance.
The exchange says deposits and services not affected by the incident remain operational. Withdrawals, however, were still suspended in its October 30 update while the company reviewed affected systems and worked toward restoring the service safely. Binance has not given a confirmed public time for the full resumption of withdrawals in that update.
For now, the confirmed position is that Binance intends to absorb the reported loss, has allocated funds to replace the stolen assets, and is continuing its technical investigation. The final recovery total, the full attack method and the identity of those responsible remain unresolved.
