This summary covers public information up to 08:30 UTC on October 31 (all times UTC). Binance is still investigating and withdrawals have not reopened, so the figures may change.

What happened

Around 20:05 on October 29, a Binance hot wallet called "Binance 14" began to be drained. A hot wallet is the online wallet an exchange uses for day-to-day withdrawals.

According to blockchain analytics firm Arkham, the attacker moved about $6 billion through 141 transfers on nine chains between 20:10 and 23:05, plus about $300 million on XRP. $4.9 billion left in the first 14 minutes, and the largest single transaction was about $2.53 billion.

Security firm Blockaid found, as reported by crypto.news, that the attack used Ethereum's EIP-7702 authorization to point the hot wallet at a contract that swept its funds.

What Binance says

At 02:25 on October 30, Binance published its initial findings:

  • The incident may have started with a compromised DevOps engineer's laptop, which let the attacker reach a service container and submit unauthorized withdrawal transactions
  • No evidence of a wallet private key leak has been found
  • The estimated total impact is about $6.3 billion, and about $3 billion has been frozen on-chain with partners
  • Losses will be covered by the SAFU fund (Binance's user protection fund) and company funds, and user funds are safe
  • Deposits and withdrawals were suspended, the affected address authorization was revoked, and law enforcement and analytics firms were brought in

Binance later said it has set aside more than $6.34 billion of company funds for the incident. $5 billion of that is already held in the same tokens that were stolen, and the rest is being bought through market and over-the-counter (OTC) channels. The roughly $3 billion that is frozen is not counted in that amount.

A second update signed by co-CEOs Yi He and Richard Teng said the investigation has found other points of breach beyond the laptop, still with no evidence of a private key leak. More technical findings are expected within about 48 hours.

How much has been frozen

Binance puts the verified frozen amount at about $3 billion. Freezing depends on token issuers: Tether and Circle can freeze the USDT and USDC they issue, and other projects froze their own tokens.

No issuer can freeze ETH or BTC. Arkham's figures show the attacker still controls about 18,270 BTC along with large amounts of ETH, TRX and SOL.

Who did it

Blockchain analytics firms TRM Labs and Chainalysis both attribute the attack to TraderTraitor, a North Korea-linked hacking group. Neither Binance nor law enforcement has publicly named the attacker.

When withdrawals come back

As of this summary, withdrawals on Binance.com are still suspended. Deposits and other unaffected services are running.

The timetable in Binance's second update:

  • The technical team aims to start restoring withdrawals within about 34 hours, once security checks are complete
  • Withdrawals will reopen in phases, and not every asset is promised to return at the same time
  • An asset snapshot comes first, with new Proof of Reserves results on November 2

Binance.US runs as a separate platform. It says it was not affected, and its deposits and withdrawals are working.

What users can do now

  • Follow only Binance's official accounts and website announcements. Impersonated support staff and fake "compensation" links are common during incidents like this.
  • Don't move assets to unknown platforms or private accounts just to get funds out faster.
  • When the Proof of Reserves is published, you can check that your own balance is included.

Sources