Binance now estimates the total impact of Thursday’s drain of its hot wallets at about $6.3 billion, well above the roughly $3.5 billion Unchained counted on Ethereum alone.
In a post on X early Friday UTC, the exchange said its initial investigation “suggests that the security incident may involve a compromised DevOps engineer’s laptop,” letting an attacker into a service container to push through unauthorized withdrawals. Binance said it found no sign of a wallet private key leak and would cover all losses from its SAFU fund and company funds. The exchange has not named an attacker and said it was working with law enforcement to identify those behind the theft.
Binance co-CEO Richard Teng wrote that “the attacker did not simply use one engineer’s permissions.” Binance co-CEO Yi He said the exchange expected to start restoring withdrawals within 48 hours.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
TRM Points to North Korea
Blockchain analytics firm TRM Labs attributed the attack with high confidence to TraderTraitor, the North Korean group the FBI blamed for Bybit’s $1.5 billion loss in February 2025. By TRM’s count, roughly $6.36 billion left Binance-controlled addresses across 10 networks, the bulk of it in a 20-minute burst that began at 20:05 UTC on Oct. 29.
TRM said the likeliest explanation is that the attacker could get Binance’s hot-wallet signing system to approve transfers on multiple chains, and noted at the time that Binance had not yet published a root cause.
On-chain investigator ZachXBT said funds from Binance and from the $388 million Bitget exploit “were commingled at the same address” after moving through THORChain and that “the same actor is likely behind both incidents.”
Frozen Funds
TRM counted about $2.7 billion frozen as of 00:30 UTC Friday, mostly stablecoins locked by Tether, Circle, Ripple and World Liberty Financial. Binance later put it at about $3 billion. As of TRM’s 00:30 UTC snapshot, the attacker still held about $2.4 billion in ether and bitcoin that no issuer could freeze (more than 420,000 ETH and 18,270 BTC), along with smaller sums on other chains.
Related Listen: Why the White House’s Hack-Back Memo Leaves North Korea Off the List
