Binance Hack: $2.84B Frozen, $3.33B Out Of Issuers' Reach

Binance lost roughly $6.3 billion from its hot wallets on October 29, and about $2.84 billion of that has been frozen so far. Everything else sits on chains where no issuer can freeze it. That split defines this Binance hack, and it decides how much money Binance can realistically win back. No other Binance hack comes close in size.

Three sources count the Binance hack differently. Binance gives about $6.3 billion. TRM Labs values the outflows at $6.36 billion using each asset's price when it moved. Elliptic reaches $6.43 billion and leaves out $169 million that left after the suspension, which appears to be Binance's own funds.

We checked the Ethereum leg directly against the chain. One USDT transfer of 1,615,409,499 tokens landed in block 26,300,770 at 20:24 UTC on October 29. That matches TRM's 1.615 billion USDT Ethereum sweep and Elliptic's 20:24 timing.

TRM describes its main attacker destination as holding 1.175 billion USDT and 823 million USDC. The recipient of that transfer holds exactly those balances. Token contract calls show Tether and Circle have blacklisted it.

What Binance Says About The Hack

Binance's first post on X on October 30 pointed to a compromised DevOps engineer's laptop. That laptop, it said, let an attacker reach a service container and submit unauthorized withdrawals. Binance added that it had found no evidence of a wallet private key leak.

Hours later it revised its account of the Binance hack. A later investigation update says the probe "uncovered additional points of breach" and calls the incident a complex attack. Binance has not named those points. Its service update says deposits work normally while withdrawals stay paused for a security revamp, with a restart expected within 48 hours.

Binance has committed to cover all losses from its SAFU fund and company funds. Its newest post says recovery of affected assets for users has begun. TRM notes that no root cause has been published.

Why Only Stablecoins Could Be Frozen

Tether froze the main Ethereum receiving address about 37 minutes after the sweep, locking 1.18 billion USDT, according to Elliptic. Circle froze 823 million USDC three minutes later. Ripple and World Liberty Financial froze their own tokens, and the Arbitrum Security Council forced 8,426 ETH out of the attacker's Arbitrum address.

Native coins were a different story. Elliptic found nothing frozen on Bitcoin, the XRP Ledger, Solana or NEAR. Before the freezes landed, the attacker had already swapped about $786 million of stablecoins into ETH and TRX.

The 18,270 stolen BTC went into a peel chain that split it across 19 addresses, mostly 1,000 BTC each. Elliptic says none of it had reached an exchange or other service when it published.

Elliptic's chart separates what issuers froze from what they cannot reach, as of 07:00 UTC on October 30. Source: Elliptic.

Who Is Blamed For The Binance Hack

TRM attributes the attack to TraderTraitor, a North Korean hacking unit. It says so "with high confidence." It cites on-chain and off-chain intelligence, plus parallels with the Bybit and KelpDAO thefts. Elliptic also assigns the theft to North Korean actors, though it lists caveats of its own.

One caveat is overlap. About $39,000 of Binance funds reached an address that also took roughly $510,000 of Bitget exploit proceeds. Another is speed, since the stablecoins sat for 37 minutes before the freeze without being converted. Elliptic adds that the laundering routes differ from the bridge-heavy pattern after Bybit.

Elliptic states that no government or law enforcement agency has confirmed the attribution, and Binance has not said who was responsible. The FBI named the Bybit attackers within five days. No equivalent statement exists for Binance yet.

Binance's investigation update on X, dated October 30. Source: Binance on X.

Binance's own status posts are the place to watch for the withdrawal restart. Its post-mortem is the one document that would settle how the withdrawals were authorized.