Binance estimates that approximately $6.3 billion in cryptocurrency was affected by an October 29 security incident. On October 31, the FBI attributed the theft to North Korea's TraderTraitor cyber activity.
What is known about the attack
In its initial statement, Binance said its preliminary investigation suggested a compromised DevOps laptop may have allowed an attacker to access a service container and submit unauthorized withdrawals. The company said it had found no evidence of wallet private-key leaks at that stage. The investigation is ongoing, and Elliptic's analysis notes that Binance subsequently identified additional points of breach. The laptop therefore should not be treated as a confirmed explanation of the entire attack.
Frozen funds and customer coverage
Binance reported that approximately $3 billion had been frozen on-chain with help from industry partners. Elliptic separately said it had verified $2.85 billion frozen or seized on-chain as of its November 1 update. These figures reflect different sources and reporting times; freezing assets is not the same as recovering them.
Binance says it will cover customer losses using its SAFU fund and its own resources. In its November 1 recovery update, the exchange said it had procured or covered roughly 95% of the affected amount and that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were 100% backed. This is Binance's account of reserve coverage, not a statement that the stolen assets have all been recovered.
Withdrawals resume in stages
Binance paused withdrawals following the incident and announced a phased restart on November 1. Its initial window covered 15 networks, with availability to be enabled gradually by asset and network. Elliptic reported that Bitcoin withdrawals reopened at 06:00 UTC. Users should check the status of their specific asset and network, as the announcement does not mean every withdrawal route has already reopened.
The FBI said stolen funds had primarily been converted to ETH and expected further laundering through services including DeFi and instant exchanges. The investigation and recovery are still developing; figures and service availability may change.
Adapted from the Chinese original, published November 1, 2026. Official statements and on-chain research have been added for context as of November 1, 2026.
Comments NOTHING