Key Notes
- Binance estimates the hack impact at $6.3 billion and promises to cover all losses using SAFU and company funds.
- Around $3 billion in affected assets is frozen, while deposits operate normally and withdrawals remain paused.
- TRM attributes the attack to North Korea’s TraderTraitor and points to compromised signing infrastructure.
Binance has put the estimated impact of its October 29 hack at around $6.3 billion and pledged to cover all losses through its SAFU emergency fund and company funds. The exchange said roughly $3 billion in affected assets had been frozen onchain and assured customers that their funds were safe.
Withdrawals remain paused, but deposits are operating normally, according to Binance’s service update at 04:36 UTC on October 30. The company expects withdrawals to resume within 48 hours while it rebuilds the withdrawal service’s security and related addresses. That is a target, rather than confirmation that access has been restored.
Binance Points to a DevOps Laptop as a Possible Entry Point
The exchange’s preliminary investigation suggests a compromised DevOps engineer’s laptop allowed an attacker into a service container, from which unauthorized withdrawals were submitted. Binance says it has found no evidence of wallet private-key leakage.
Its subsequent update says multiple factors were involved and that investigators are tracing the full attack path. The laptop remains a possible entry point; a comprehensive root-cause report has yet to be published. Binance also says it revoked affected address authorization and engaged law enforcement and blockchain intelligence partners.
The first company statement described a precautionary suspension of both deposits and withdrawals. The later service update supersedes that description for deposits. Binance has promised an updated Proof of Reserves after remediation, alongside the technical post-mortem.
Ethereum Wallets Were Drained More Than Once
Blockchain intelligence firm TRM Labs estimates that $6.36 billion was taken across ten chains, valued when each transfer occurred. Its Ethereum component is approximately $3.79 billion, higher than the earlier $3.3–$3.5 billion estimates. TRM’s figure and Binance’s rounded $6.3 billion describe the same developing incident and should not be added together.
The main Ethereum transaction, at 20:24:23 UTC, moved approximately 167,464 ETH and 63 tokens from the address labelled Binance 14, including about 1.615 billion USDT. Subsequent sweeps took newly arriving funds. TRM also describes another Ethereum hot wallet sending 28,006 ETH alongside other tokens, and a separate smart account losing 823 million USDC.
Bitcoin, Tron, Solana, XRP Ledger and several Ethereum scaling networks were also affected. The incident extended to Avalanche and Polygon later in the night. Our earlier report covers the initial wallet analysis and withdrawal restrictions before Binance supplied its larger impact estimate.
Prepared Signatures Enabled Repeated Sweeps
According to TRM’s reconstruction, preparation began at least 36 hours before the theft. An operator wallet received small Tornado Cash withdrawals on October 28; the attacker then deployed and tested code on separate wallets. The first movements occurred on XRP Ledger around 20:05 UTC on October 29, before the major Ethereum sweep.
On Ethereum, the attacker submitted 50 pre-signed EIP-7702 authorizations covering consecutive transaction counters, or nonces. This increased the chance that an authorization would match the busy Binance wallet’s counter when executed. The accepted delegation let attacker-controlled code repeatedly sweep the wallet, including funds arriving after the initial drain.
The EIP-7702 specification permits an ordinary Ethereum account to delegate execution to smart-contract code through a signed authorization. Such code can exercise extensive authority over the account. Its use here does not establish a vulnerability in Ethereum’s consensus or a network-wide breach.
Other affected wallets produced ordinary signed transfers without that delegation. TRM interprets the coordinated activity across different chains as evidence of compromised signing infrastructure. Access to a signing service can enable unauthorized transactions without proving that private keys were extracted. That distinction matters alongside Binance’s statement that it has found no evidence of a key leak.
TRM Attributes the Attack to North Korea’s TraderTraitor
TRM attributes the theft to the North Korean group TraderTraitor with high confidence, citing onchain and offchain intelligence. This is the firm’s assessment; Binance says it is working with law enforcement to establish the criminals’ identity. A final company forensic report has not yet confirmed the full attack path.
Frozen Assets and the Coverage Pledge Are Different Measures
Binance’s earlier clarification put verified frozen assets at $2.54 billion. Its subsequent impact statement raised that figure to around $3 billion. These are successive estimates, not separate amounts to combine.
Freezing restricts movement of affected assets; it does not, by itself, mean those assets have been returned. Binance’s commitment is to cover all losses using both SAFU and its own funds. The statement does not say SAFU alone contains $6.3 billion or provide a completed reimbursement accounting.
How $6.3 Billion Compares With Other Major Crypto Hacks
The scale becomes clearer beside selected historical headline estimates. These rounded values reflect prices and reporting methods around each incident, rather than today’s token prices:
- Binance, 2026: approximately $6.3 billion, according to the exchange’s preliminary impact estimate.
- Bybit, 2025: approximately $1.5 billion, documented by Chainalysis.
- Ronin Network, 2022: approximately $625 million.
- Poly Network, 2021: approximately $611 million.
- BNB Chain bridge, 2022: approximately $570 million in gross unauthorized token issuance.
- Coincheck, 2018: approximately $534 million.
- Mt. Gox, 2014: approximately $450 million at then-prevailing prices; historical datasets differ.
Using those six comparison figures, their combined headline value is approximately $4.29 billion. Binance’s $6.3 billion estimate is about 4.2 times Bybit’s and 10.1 times Ronin’s, and exceeds all six combined.
These are comparisons of incident scale, not unrecovered losses. Nansen’s bridge analysis, for example, valued the unauthorized BNB issuance at $566 million, with about $137 million moved to other chains. Other historical values vary across DefiLlama’s research and the Blockchain Breaches archive. The selection is not an exhaustive ranking. TRM describes the Binance incident as the largest crypto theft on record.
Bitcoin Fell Below $77,000 During the Overnight Turmoil
Coinbase hourly data show Bitcoin reached $76,301.02 in the candle beginning at 02:00 UTC on October 30. That is an overnight historical low, rather than a current price quote. Our initial market coverage follows the earlier selloff and wallet alerts; the timing alone does not establish that the hack caused every price move.
A separate Polymarket exploit reportedly involved roughly $2.65 million, according to The Block. Polymarket said the third-party compromise was resolved, trading resumed and affected users would be reimbursed. No established connection links that incident to the Binance attack.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
